Text Escape and Unescape

What this tool does

This tool puts common text escaping operations in one place. The input is transformed as you switch modes, and the result can be copied, downloaded, or used as the next input for another conversion.

Enable batch mode to convert every line independently, or load a text file to process its contents. Each line is handled on its own, so one invalid line does not stop the rest.

All processing happens in the current browser tab. Text is never uploaded to a server.

HTML escape and unescape

HTML escaping replaces characters that have special meaning in markup with entities. For example:

<p>Tom & Jerry's</p>

becomes:

<p>Tom & Jerry's</p>

The tool escapes &, <, >, ", and '. Unescaping supports common entities such as &, <, >, ", ', and ', plus decimal and hexadecimal numeric entities such as 你. This is useful for displaying user input, but it is not a complete HTML sanitizer or security filter.

XML escape and unescape

XML escaping uses the same five characters as HTML but emits the XML-friendly ' entity for a single quote instead of ':

<price currency="USD">5 > 3 & 2</price>

becomes:

<price currency="USD">5 > 3 & 2</price>

Unescaping restores &, <, >, ", ', ', and numeric entities. It only restores characters; it does not validate or sanitize XML.

URL encode and decode

URL encoding uses the browser's encodeURIComponent, which is intended for query parameter values, path fragments, or other standalone text that will be placed in a URL:

你好 & hello?

produces a value similar to:

%E4%BD%A0%E5%A5%BD%20%26%20hello%3F

This mode encodes structural characters such as /, ?, &, and =, so it should not be used to encode an entire URL. Decoding requires valid percent sequences such as %E4%BD%A0; encoding an already encoded value creates double encoding.

Unicode encode and decode

Unicode encoding outputs each Unicode code point as uppercase U+XXXX text separated by spaces:

A 你好😀

becomes:

U+0041 U+0020 U+4F60 U+597D U+1F600

Decoding accepts both U+4F60 and \\u4F60, along with 4- to 6-digit hexadecimal code points. Invalid or out-of-range code points are left unchanged.

Base64 text encode and decode

Base64 converts the UTF-8 bytes of text into printable ASCII. For example, Hello becomes SGVsbG8=. The tool uses UTF-8 so Chinese text and Emoji do not become corrupted by a direct btoa call.

Base64 is an encoding, not encryption. Anyone with the result can recover the original text, so it must not be used to protect passwords, keys, or private data. These modes are for text; use the standalone Base64 tool for files, Data URLs, and URL Safe Base64.

JavaScript string escape and unescape

JavaScript escaping converts each character into a JavaScript hexadecimal escape: \xHH for code points up to 0xFF, \uHHHH for BMP code points, and surrogate-pair \uHHHH\uHHHH sequences for astral characters. Characters such as line breaks are also represented by their hexadecimal code points:

Hi 你好

becomes:

\x48\x69\x20\u4F60\u597D

Unescaping accepts \xHH, \uHHHH, and \u{...} sequences. This is useful for embedding arbitrary text in a JavaScript source string without quoting problems.

JSON string escape and unescape

JSON string escaping applies standard JSON rules to newlines, double quotes, backslashes, and control characters, while retaining the surrounding quotes:

line
"quoted"

becomes:

"line\n\"quoted\""

The output is one complete JSON string value, not a JSON object or array. Unescaping parses a complete JSON string literal, including its surrounding double quotes, back into the original text. Use the JSON Formatter when you need to format a complete JSON document.

SQL single-quote escape and unescape

The SQL mode doubles each single quote inside the input:

SELECT 'name'

becomes:

SELECT ''name''

This implements the single-quote doubling rule for SQL string literals. Unescaping collapses each doubled pair back into one single quote. It does not parse SQL and does not replace parameterized queries, prepared statements, or a database driver's safe query API.

Batch conversion

Turn on batch mode to treat the input as multiple lines. Every line, including empty lines, is converted with the selected mode and the results are joined back with newlines. A line that fails to decode, such as a URL with an incomplete percent sequence, is kept unchanged rather than aborting the whole batch.

Use the Load file button to read a .txt, .md, or .csv file into the input, then copy or download the converted lines.

Common questions

Why did URL decoding fail?

The input may contain a % that is not followed by two hexadecimal characters, an incomplete encoding, or bytes that are not valid UTF-8. Make sure the input is a complete encoded URL component.

Why is decoded Base64 text corrupted?

The original bytes may not be UTF-8, or the input may be Base64 for a binary file rather than text. Use the standalone Base64 file mode for binary content.

Does HTML unescaping remove dangerous tags?

No. It only restores characters and does not remove scripts, event attributes, or other HTML. Use a reliable HTML sanitization strategy before inserting the result into a page.

Privacy

Input, output, and conversion all stay in the current browser tab. Nothing is sent to a server or written to local storage.