JavaScript escape and unescape

What a JavaScript escape changes in your text

A string literal in JavaScript ends at the next unescaped quote of the kind that opened it, and it may not contain a raw line break. Text copied from a log, a form or a Windows path rarely respects either rule. Escaping rewrites the troublesome characters as backslash sequences the parser turns back into the originals: \" and \' for quotes, \\ for a backslash, \n and \r for line breaks, \t for a tab. The result can be pasted between quotes in source code, a configuration script or a browser console and produces exactly the string you started with.

Both quote marks are escaped every time. That makes one output valid in either quoting style, at the cost of an extra backslash in words like it\'s. Letters with accents and emoji stay readable unless you ask for pure ASCII.

Quoted strings, template literals and inline scripts

Backticks bring two hazards of their own. A raw backtick closes the template early, and a dollar sign followed by an opening brace starts an embedded expression that executes. The Template literal choice writes \` and \$ so neither can happen, and because JavaScript ignores a needless backslash in front of those characters, the same output still reads correctly between ordinary quotes.

A script embedded directly in HTML has a problem that no JavaScript rule explains. The page’s HTML parser decides where the script element stops before the JavaScript engine reads a single token, and it stops at </script even in the middle of a string. The inline script option writes each less-than sign as \x3C, which the HTML parser passes over and JavaScript decodes back to <.

The octal trap behind NUL, and other measured details

Many escapers write the null character as \0. That works until a digit follows it: "\01" is a legacy octal escape, which an old sloppy-mode script reads as U+0001 and strict mode, modules and template literals refuse to parse. This page always writes \x00, which means NUL regardless of what comes next.

The line separator U+2028 and paragraph separator U+2029 have been legal inside string literals since ES2019, yet before that they counted as line terminators and broke JSONP responses and older engines, so they are escaped too. A lone surrogate, half of an emoji without its partner, is a perfectly valid JavaScript string value, but UTF-8 has no way to store it; copying or saving it silently produces U+FFFD. Written as \uD800, it survives. Every one of these behaviors was checked against the JavaScript parsers in Chromium and WebKit, not taken from memory.

Unescaping without running anything

The reverse direction decodes every escape the language defines: the single-letter forms, two-digit \x41, four-digit \u00E9, the braced \u{1F600}, surrogate pairs and a backslash placed before a line break, which JavaScript treats as a line continuation and removes. It uses its own reader and never evaluates your input, so untrusted text is safe to paste. When a sequence would throw a SyntaxError, such as \x4g, \u12 or the octal \101 in strict mode, it stays exactly as written and the page lists its position. An unnecessary escape like \q is decoded to q, since that is what the engine does, with a note so the vanished backslash is not a surprise.

Why pasted Windows line endings disappear

Browsers normalize the contents of every textarea, replacing each CR LF pair with a bare LF before scripts on the page can see it. Text you paste here has therefore lost its carriage returns already, and the counter beside the field shows the line endings that actually arrived. Opening the file instead reads its bytes directly, keeps the carriage returns, and escapes each one as \r. That matters for template literals in particular, where a raw carriage return is quietly read as a line feed.

Neighboring string and code tools

The same text often needs a different container. For a JSON payload, JSON escaping follows stricter rules with no single quotes or hex escapes. Markup takes ampersand entities instead of backslashes: use HTML escaping for a web page and XML escaping for a feed or configuration document. To tidy a whole script, the JavaScript formatter lays it out and the JavaScript minifier shrinks it, while JavaScript to JSON turns an object literal into strict JSON.

Your text stays in this tab

Everything on this page runs as JavaScript inside your browser, and inputs large enough to slow the page move to a background worker served from the same site. There is no upload, no copy of your text in the address bar and no server log to hold it. API keys, tokens and snippets of production code are exactly what people escape, so check the network panel of your developer tools while typing if you want proof.