Using the tool
Paste text on the left and the escaped form appears on the right, ready to drop between quotes. Swap the boxes to unescape.
Quotes decides between the body on its own and the whole thing wrapped in double quotes. Body only is the default, since the usual job is pasting into a string that already has its own.
Unescaping accepts either form, so a value copied straight out of a JSON file with its quotes attached works without trimming.
What has to be escaped
Five characters cannot appear raw inside a JSON string: the double quote, the backslash, and the control characters below U+0020, of which newline, carriage return and tab have short forms. Everything else may appear as itself.
The escapes are \" and \\ for the first two, \n, \r and \t for the common control characters, and \u followed by four hex digits for the rest. A form feed is \f and a backspace is \b, which almost nobody writes on purpose.
The forward slash may be escaped as \/ and does not have to be. That option exists so JSON can be embedded inside a script tag without the sequence </ ending it early, and it is why you sometimes see URLs full of backslashes in JSON produced by PHP.
Good, not Evil, and other licence trouble
JSON was specified by Douglas Crockford, who says he discovered it rather than invented it, since it was already a subset of JavaScript. The format is small enough that its grammar fits on one page.
The licence on his Java implementation is less small. It is the MIT licence with one sentence added: "The Software shall be used for Good, not Evil." That restricts the field of use, which makes it non-free by the standard definitions, so Debian and the Free Software Foundation reject it and Apache told its projects to drop the code.
Crockford has said he sent IBM's lawyers a letter granting their customers permission to use JSON.org's code for evil. The clause stays. The format itself carries nothing of the kind, because a data format cannot be licensed at all.
Related conversions
URL decode solves the same class of problem for a different destination, escaping the characters a query string cannot hold. Unicode converter shows the code point behind a character when a \u escape is not obvious.
For turning whole structures rather than one string, start at JSON to CSV.
Questions
How do I escape a string for JSON?
Paste it above and copy the result. Quotes and backslashes are escaped, and control characters become \n, \t or a \u sequence.
Do I need the surrounding quotes?
Only if you are writing the whole value. The Quotes control adds them, and the default leaves them off for pasting into a string that already has its own.
Why is my forward slash escaped somewhere else but not here?
Escaping it is allowed but not required. Some encoders do it so JSON can sit inside a script tag without the sequence </ closing it early.
Does it handle emoji?
Yes. Characters above the basic plane are left as themselves, which is valid JSON, and they survive a round trip unchanged.