OneFreePlace
TOOL #351 · JAVASCRIPT STRINGS

JavaScript Escape / Unescape

A browser-local JavaScript string-literal workbench for single quotes, double quotes and template literals — with exact UTF-16 preservation, modern Unicode escapes, script-tag-safe output, legacy escape diagnostics, template-interpolation protection and semantic round-trip verification.

JS literal awareSingle · double · templateNo evalScript-tag safeLegacy escape auditRound-trip verifiedBatch ZIPNo upload
Input
Verified output
UTF-16 units0
Code points0
Escapes0
UTF-8 bytes0 → 0
Literal form—
Verification—
Processing0 ms

JavaScript string audit

ReadyConvert input to run literal-safety and escape diagnostics.

Why this is safer than adding backslashes

The engine models JavaScript string escapes instead of blindly replacing characters. It protects template interpolation, validates \x/\u/\u{...}, distinguishes strict-mode from legacy octal escapes, handles line continuations, preserves lone UTF-16 surrogates exactly, and reverses every generated literal before Copy/Download is enabled. Production code never uses eval or Function.

Engine ready. Ctrl/Cmd + Enter converts.

Escape profile

Recognized escapes0
Errors0
Warnings0
UTF-16 units0
Code points0
HTML script closers0

Inspector parses escapes without executing JavaScript. Template interpolation is reported rather than evaluated.

Escape tokens

#Line:ColRaw escapeKindDecodedCode point

No escapes inspected yet.

Batch JavaScript string processor

Process multiple text/code files with the current settings. Files stay in the browser; successful outputs are packed into one local ZIP.

Drop or choose text/code files

No files selected.

Used when the selected strategy escapes non-ASCII characters. Lone surrogate code units always use \uXXXX.

Changes spelling only, never the resulting JavaScript string value.

The Script-safe strategy already escapes <, > and &, which blocks literal </script> termination.

Other strategies use explicit newline escapes for clearer transport/source safety.

Off by default because modules, strict mode and template literals reject legacy octal forms.

Use 2+ only when intentionally unpacking double-escaped text such as \\n.

Generated text downloads are UTF-8.

Malformed \x/\u, unbalanced delimiters, raw quoted-string newlines, template interpolation and legacy numeric escapes are fail-closed by default. Identity escapes such as \q are decoded with a warning because ECMAScript permits them.

Conversion, inspection, file decoding and ZIP generation are local. The production tool never evaluates input as JavaScript and has no conversion API, upload endpoint or account requirement.

1. Pick the destination literal

Double and single quoted literals escape their own delimiter and raw line terminators. Template literals additionally protect backticks and literal ${...} openers so pasted text cannot turn into interpolation. Body modes omit the surrounding quotes while applying the same escape rules.

2. Choose an escape strategy

Minimal changes only syntax/control characters required for a correct literal. Source-safe additionally escapes bidi/zero-width controls. Script-safe also escapes HTML-sensitive <, > and &. ASCII-only represents every non-ASCII character with JavaScript escapes.

3. Unicode and UTF-16

Modern ECMAScript supports code-point escapes such as \u{1F600}. UTF-16 compatibility mode emits supplementary characters as surrogate pairs such as \uD83D\uDE00. Lone surrogate code units are preserved as \uXXXX instead of being replaced.

4. Unescape without executing code

The parser understands simple escapes, \xHH, \uHHHH, \u{...}, escaped delimiters and JavaScript line continuations. It never calls eval or executes template expressions. A wrapped template containing unescaped ${...} is blocked because that is executable syntax, not plain string data.

5. Legacy source recovery

Old sloppy-mode source can contain octal escapes or \8/\9. Modern strict/module code rejects these forms. They are therefore blocked by default and available only behind the explicit legacy setting, with warnings.

6. HTML <script> embedding

JavaScript string escaping and HTML parsing are different layers. If a literal is inserted directly into an HTML script element, a literal closing script tag can terminate the element before JavaScript sees the string. Script-safe mode escapes the HTML-sensitive characters while preserving the JavaScript value.

7. Verification

Every escaped result is parsed back by the independent unescape path and compared with the original UTF-16 string value. Copy/Download remains disabled if that semantic round trip fails. This catches quote, surrogate, template and backslash mistakes that simple replacement tools can miss.

8. Privacy and limits

Everything runs locally. This tool handles JavaScript string literal text, not complete source programs or regular-expression literals. It does not evaluate expressions, interpolate templates, rewrite source ASTs or claim that arbitrary surrounding HTML/JavaScript context is safe.

Common example

Input:  He said "Hi" & ${name} 😀
Template output: `He said "Hi" & \${name} 😀`
Script-safe double output: "He said \"Hi\" \x26 ${name} 😀"

FAQ

Why not use JSON.stringify? JSON strings are a useful subset, but JavaScript also has single-quoted strings, template literals, \v, identity escapes, code-point escapes and legacy-source concerns. This tool makes those choices explicit.

Does unescape run my code? No. Input is parsed as text only. Template interpolation is blocked.

Why is octal disabled? It is legacy syntax and fails in strict/module code.