1. Pick the destination literal
Double and single quoted literals escape their own delimiter and raw line terminators. Template literals additionally protect backticks and literal ${...} openers so pasted text cannot turn into interpolation. Body modes omit the surrounding quotes while applying the same escape rules.
2. Choose an escape strategy
Minimal changes only syntax/control characters required for a correct literal. Source-safe additionally escapes bidi/zero-width controls. Script-safe also escapes HTML-sensitive <, > and &. ASCII-only represents every non-ASCII character with JavaScript escapes.
3. Unicode and UTF-16
Modern ECMAScript supports code-point escapes such as \u{1F600}. UTF-16 compatibility mode emits supplementary characters as surrogate pairs such as \uD83D\uDE00. Lone surrogate code units are preserved as \uXXXX instead of being replaced.
4. Unescape without executing code
The parser understands simple escapes, \xHH, \uHHHH, \u{...}, escaped delimiters and JavaScript line continuations. It never calls eval or executes template expressions. A wrapped template containing unescaped ${...} is blocked because that is executable syntax, not plain string data.
5. Legacy source recovery
Old sloppy-mode source can contain octal escapes or \8/\9. Modern strict/module code rejects these forms. They are therefore blocked by default and available only behind the explicit legacy setting, with warnings.
6. HTML <script> embedding
JavaScript string escaping and HTML parsing are different layers. If a literal is inserted directly into an HTML script element, a literal closing script tag can terminate the element before JavaScript sees the string. Script-safe mode escapes the HTML-sensitive characters while preserving the JavaScript value.
7. Verification
Every escaped result is parsed back by the independent unescape path and compared with the original UTF-16 string value. Copy/Download remains disabled if that semantic round trip fails. This catches quote, surrogate, template and backslash mistakes that simple replacement tools can miss.
8. Privacy and limits
Everything runs locally. This tool handles JavaScript string literal text, not complete source programs or regular-expression literals. It does not evaluate expressions, interpolate templates, rewrite source ASTs or claim that arbitrary surrounding HTML/JavaScript context is safe.
Common example
Input: He said "Hi" & ${name} 😀
Template output: `He said "Hi" & \${name} 😀`
Script-safe double output: "He said \"Hi\" \x26 ${name} 😀"FAQ
Why not use JSON.stringify? JSON strings are a useful subset, but JavaScript also has single-quoted strings, template literals, \v, identity escapes, code-point escapes and legacy-source concerns. This tool makes those choices explicit.
Does unescape run my code? No. Input is parsed as text only. Template interpolation is blocked.
Why is octal disabled? It is legacy syntax and fails in strict/module code.