JSON Escape and Unescape

What it does

Escaping turns a document into a string that contains it. Unescaping turns that string back. They are inverse operations, and the way to trust either is to apply the other and compare.

Escape: serialise the input and then quote it, so every quote and backslash inside is escaped. Unescape: parse a JSON string literal and return the document it holds. Round-trip is reported.

Why it works this way

Escaping is not encoding and not encryption — the content is unchanged and readable, only the characters that would end the string early are marked.

The two directions fail differently. Unescaping input that is not a JSON string is a parse error and is reported as one. Escaping never fails, because any text can be put in a string.

The check worth trusting is the round trip. Applying escape then unescape must return the original bytes, and the tool reports whether it did rather than asserting it in prose.

Examples

{"a": "he said \"hi\""}

"{\"a\": \"he said \\\"hi\\\"\"}"

"{\"a\":1}"

{"a":1}

Inputs and outputs

• the text to escape or unescape
• direction

• the escaped string, or the unescaped document
• whether the round-trip returned the input unchanged

Edge cases

• already escaped input — escaping twice is not idempotent and the tool says so
• unicode escapes \u0041
• a string containing only a backslash
• input that is a JSON number, not a string — unescape must reject it

Sources

• RFC 8259, section 7 (String)