JSON escape

The escaped form on the right is ready to drop between quotes. Swap the boxes to unescape.

Quotes decides between the body on its own and the whole thing wrapped in double quotes. Body only is the default, since the usual job is pasting into a string that already has its own.

Unescaping accepts either form, so a value copied straight out of a JSON file with its quotes attached works without trimming.

Only 34 characters can't appear raw inside a JSON string: the double quote, the backslash, and the 32 control characters from U+0000 to U+001F, of which newline, carriage return and tab have short forms. Everything else may appear as itself.

The escapes are \" and \\ for the first two, \n, \r and \t for the common control characters, and \u followed by four hex digits for the rest. A form feed is \f and a backspace is \b, which almost nobody writes on purpose.

The forward slash may be escaped as \/ and doesn't have to be. That option exists so JSON can be embedded inside a script tag without the sequence </ ending it early. It's also why JSON produced by PHP sometimes has URLs full of backslashes.

JSON was designed to be a subset of JavaScript. RFC 4627 lists that among its goals, and until 2019 it wasn't quite true.

JSON lets U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR sit raw inside a string. JavaScript string literals didn't allow them, so a JSON string holding either one, pasted into a script as a literal, was a syntax error.

Mark Miller and Mathias Bynens proposed fixing JavaScript rather than JSON, and ES2019 accepted both characters in strings. For older engines, escaping them as \u2028 and \u2029 is still the safe choice.

URL decode solves the same class of problem for a different destination, escaping the characters a query string can't hold. Unicode converter shows the code point behind a character when a \u escape isn't obvious.

For turning whole structures rather than one string, start at JSON to CSV.