How-to guide

How to Escape JSON Strings

JSON requires seven characters to be escaped inside a string: the double quote, the backslash, and the control characters for backspace, form feed, newline, carriage return and tab. Anything below U+0020 must use a \u escape. Escaping matters most when embedding JSON inside JSON, where every backslash doubles at each level of nesting.

JSON Escape and Unescape

Escape text for use inside a JSON string, or decode it back.

Open the tool

Escaping is usually invisible because a serialiser does it for you. It becomes visible at exactly two moments: when you hand-write a JSON string containing a quote, and when a payload has to carry another JSON document inside one of its values.

The second case is where the confusion lives. Each level of embedding doubles the backslashes, so a quote that is already escaped once appears as three characters at the next level and seven at the one after.

Step by step

Escape the two structural characters
A double quote inside a string becomes \" and a backslash becomes \\. These two are mandatory, because both would otherwise change where the parser thinks the string ends.
Escape control characters by name
Newline is \n, carriage return \r, tab \t, backspace \b and form feed \f. A literal newline inside a JSON string is invalid, which is why a multi-line value has to be escaped rather than wrapped.
Use \u for anything else below U+0020
Control characters without a shorthand must be written as \u followed by four hex digits — a null byte is \u0000. Ordinary text above U+0020 never needs escaping in a UTF-8 document, including accented letters and emoji.
Escape the forward slash only when you want to
JSON permits \/ but does not require it. The convention exists so that </script> cannot appear inside JSON embedded in an HTML page. Escaping it is harmless; not escaping it is equally valid.
Escape once per level when nesting
To put a JSON document inside a JSON string value, escape the whole thing as a unit. {"a":"b"} becomes "{\"a\":\"b\"}". Doing it twice by hand is where the backslash counts stop making sense — let a tool handle each level.

Example

The same object, then that object embedded as a string value inside another.

Original

{"name":"Ada","note":"He said \"hi\""}

Embedded as a string

{
  "payload": "{\"name\":\"Ada\",\"note\":\"He said \\\"hi\\\"\"}"
}

Frequently asked questions

Which characters must be escaped in JSON?

The double quote, the backslash, and the control characters below U+0020. Newline, carriage return, tab, backspace and form feed have shorthand escapes; everything else in that range uses \u with four hex digits.

Do I need to escape single quotes?

No. JSON strings are always delimited by double quotes, so an apostrophe is an ordinary character. Escaping it produces \' which is not valid JSON and will be rejected by a strict parser.

Why do the backslashes keep doubling?

Because each level of embedding escapes the level below. A quote is \" at one level, \\\" at two and \\\\\\\" at three. The count is correct even when it looks absurd, which is why nesting should be done by a tool rather than by hand.

Do accented characters and emoji need escaping?

No, provided the document is UTF-8. They may optionally be written as \u escapes for transports that are not binary-safe, but a literal é or 😀 inside a JSON string is perfectly valid.

Should I escape forward slashes?

It is optional. The only real reason is embedding JSON in an HTML script tag, where an unescaped </script> would end the tag early. Otherwise it makes no difference to validity or meaning.

Tools used in this guide

All tools →

All guides →

Last reviewed 28 August 2026.