Loading…
Escape/unescape JS strings. Use for code literals; for JSON strings use json-escaper. Input: text ≤10MB. Returns escaped text. 100% client-side.
String Escape/Unescape is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Escapes and unescapes strings across 7 modes: JavaScript, JSON, HTML, URL, SQL (single quote), SQL (double quote), and CSV. Provides three character targeting options (all special chars, only quotes, only backslashes). Includes a character map display showing each character's transformation side-by-side and real-time input vs output length preview.
Injection attacks (XSS, SQL injection, CSV injection) are often caused by improper string escaping. A dedicated tool covering multiple contexts helps developers understand and apply correct escaping for their specific use case.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
Web developers sanitizing user input, security engineers auditing code for injection vulnerabilities, QA testers crafting injection test cases, and anyone debugging encoding issues in data pipelines.
Paste your input string into the text area
Select escape/unescape mode from 7 options: JavaScript, JSON, HTML, URL, SQL (single/double quote), CSV
Choose character targeting: 'All Special Characters', 'Only Quotes', or 'Only Backslashes'
Click 'Escape' or 'Unescape' — result appears with size comparison
Open 'Character Map' panel for a table showing each character's escaped counterpart
Copy result to clipboard or use 'Swap' for iterative escaping/unescaping
Input: 'Hello "World" & <test>' | HTML | Escape => Output: 'Hello "World" & <test>'Input: 'Hello%20World%21' | URL | Unescape => Output: 'Hello World!'Difference between JavaScript and JSON escaping?
JSON also escapes slash (/) and uses strict double quotes. JS mode allows both quote types.
Can this help prevent XSS?
Yes, with correct context matching. But sanitization libraries are recommended for comprehensive XSS prevention.
What is CSV injection?
When a cell starts with =, +, -, or @, interpreted as formulas. CSV escape prevents this.
SQL double-quote mode?
Escapes double quotes by doubling them. For identifier quoting (table/column names) in double quotes.
Authoritative specifications, standards, and in-depth reading for String Escape/Unescape.
Free online Base64 encoder and decoder with URL-safe mode. Use as default for text; for split encode-only/decode-only URLs use base64-encoder/base64-decoder (aliases), for image files use image-to-base64. Input: text ≤10MB. Returns Base64 string or decoded text + error location. Convert instantly in your browser.
Free online URL encoder and decoder for query strings and components. Private client-side conversion.
Encode/decode HTML entities (& < >). Use for HTML text; for URLs use url-encoder. Input: text ≤10MB. Returns encoded/decoded text. 100% client-side.
Convert text to binary and back. Use for binary strings; for other bases use base-converter. Input: text ≤10MB. Returns 0/1 string or decoded text. 100% client-side.
Convert text to hex and back. Use for hex encoding; for hashes use hash-generator. Input: text ≤10MB. Returns hex string or decoded text. 100% client-side.
Convert images to Base64 encoded strings online for free. Use for image files only; for text use base64. Input: image file ≤10MB. Returns Base64 data URI for HTML/CSS/JS. Generate Base64 data URIs for embedding images directly in HTML, CSS, and JavaScript code.
Translate text to Morse code and back. Use for learning or signaling. Input: text ≤10MB. Returns dots/dashes or decoded text. 100% client-side.
Count characters, words, lines, and bytes. Use for quick length checks; for full stats use word-counter. Input: text ≤10MB. Returns counts. 100% client-side.