Why JSON strings need escaping
A JSON string sits between double quotes, so a literal " inside it must be written \", a backslash \\, and line breaks and tabs \n and \t. Control characters below U+0020 are not allowed raw at all. Pasting a multi-line SQL query, a Windows path or HTML with attributes into a config file or an API payload breaks the JSON unless those characters are escaped.
Unescape does the opposite: it turns a string copied from a log or an API response, full of \n and \u00e9, back into the text it represents.
Worked example
The text
C:\Users\ana
She said "hi"
escapes to C:\\Users\\ana\nShe said \"hi\". Wrapped in quotes, that is a valid JSON string, and JSON.parse returns the original two lines.
How this works
Escaping follows RFC 8259 §7 by passing the text through JSON.stringify: quotation marks and backslashes get a backslash, line feed, carriage return, tab, backspace and form feed use their short escapes, other control characters become \u00XX, and everything else, including accents and emoji, stays as it is. The surrounding quotes are optional. Unescaping parses the input as a JSON string, so \u sequences, including surrogate pairs for emoji, are decoded. Everything runs in this tab.
Frequently asked
Which characters must be escaped in JSON?
The quotation mark, the backslash and control characters U+0000–U+001F. Everything else may appear as is in UTF-8.
Do I need to escape the forward slash?
No. \/ is allowed but optional; it only helps when JSON is embedded in an HTML <script> tag.
Why is \\x41 rejected?
JSON has no \x escape. Use \u0041 instead.
Is single-quote escaping needed?
No. JSON strings use double quotes only, so ' needs no escape, and \' is invalid.
Sources
- RFC 8259 — The JavaScript Object Notation (JSON) Data Interchange Format
- ECMA-262 — ECMAScript Language Specification
- Wikipedia — JSON
Reviewed Oct 17, 2026 · test vectors fixtures/dev/json-escape/