JSON Escape Characters Explained: Quotes, Backslashes & Unicode

In JSON, you must escape a character when it would otherwise break the string it lives in. That means the double quote (\"), the backslash (\\), and the control characters like newline (\n) and tab (\t). You escape them by putting a backslash in front, and JSON only allows a specific, short list of these sequences. Everything else stays as-is.

Here is the whole set, why each one exists, and how to escape a string fast when you do not want to do it by hand.

Why JSON needs escape characters at all

A JSON string is wrapped in double quotes: "hello". So the parser needs a way to tell the difference between a quote that ends the string and a quote that is part of the text. If you write "she said "hi"", the parser sees the string end right after said , then chokes on the leftover hi"". Escaping fixes this: "she said \"hi\"" tells the parser “this quote is data, not a delimiter.”

The backslash has the same problem. Since backslash is the escape marker itself, a literal backslash has to be written as two: \\. And control characters (newline, tab, and friends) are not allowed to sit raw inside a JSON string at all. A real line break in the middle of a string is a syntax error, so you write \n instead.

That is the core idea behind every rule below. You escape special characters in JSON so the text inside a string can never be confused with the structure around it.

The full list of JSON escape sequences

JSON defines exactly these escape sequences. There are no others (a backslash followed by anything not on this list is invalid JSON).

Sequence	Meaning
\"	Double quote
\\	Backslash
\/	Forward slash (optional)
\b	Backspace
\f	Form feed
\n	Line feed (newline)
\r	Carriage return
\t	Tab
\uXXXX	Unicode code point, four hex digits

Two things surprise people here. First, the forward slash / does not need escaping, \/ is legal but pointless in most cases (it exists so you can write <\/script> safely inside HTML). Second, the single quote ' is never escaped in JSON, because JSON strings only use double quotes. If you see \' in your data, that is JavaScript or some other format leaking in, and it is not valid JSON.

These nine forms are the complete set of json escape sequences. Anything a parser accepts beyond this (like \x41 in some languages) is a non-standard extension, not JSON.

Escaping double quotes and backslashes (the two you’ll hit most)

In real work, \" and \\ are the two you meet again and again. To escape double quotes in JSON, put a backslash before each one:

{ "quote": "He said \"stop\" and left." }

Backslashes come up a lot with Windows file paths and regular expressions. A path like C:\Users\mezi has to become:

{ "path": "C:\\Users\\mezi" }

Each single backslash turns into two. Miss one and the parser reads \U as an unknown escape and rejects the whole document. Regex patterns are the classic trap, because they are already full of backslashes. The pattern \d+\.\d+ stored in JSON becomes "\\d+\\.\\d+". If you are hand-writing config and something “valid-looking” keeps failing, count your backslashes first.

Control characters: newline, tab, carriage return

You cannot press Enter inside a JSON string. A literal newline in the source is invalid, so multi-line text uses \n:

{ "note": "line one\nline two" }

Tabs use \t, and carriage return uses \r. Text copied from Windows often carries \r\n at the end of each line, so do not be surprised to see both. Backspace (\b) and form feed (\f) exist in the spec but you will almost never type them on purpose.

The rule of thumb: any character below code point U+0020 (the space character) must be escaped, either with one of the shorthand forms above or with a \uXXXX sequence. Raw control characters are simply not allowed inside a JSON string.

Unicode escapes (\uXXXX) and when to use them

The \uXXXX form writes any character by its Unicode code point, using exactly four hexadecimal digits. So \u00e9 is é and \u2764 is a heart. You rarely need this, because JSON is UTF-8 by default and you can put é or an emoji straight into the string. Modern parsers handle raw UTF-8 fine.

You reach for json unicode escape sequences in three situations: when a character is invisible or ambiguous (a non-breaking space, \u00a0, looks exactly like a normal space), when your transport layer is not UTF-8 safe, or when you want to force plain ASCII output so the file survives any pipeline.

Characters outside the Basic Multilingual Plane (most emoji, for instance) need a surrogate pair, two \u escapes back to back. The 😀 emoji is \ud83d\ude00. You will not write that by hand often, but it is worth recognizing when a “broken” emoji shows up as two odd-looking escapes.

Escaping vs encoding, a common mix-up

People say “encode” when they mean “escape,” and the two are different. Escaping is what we have described: swapping a character for a backslash sequence so it is safe inside a JSON string. Encoding is turning text into bytes (UTF-8, for example) or into a transport-safe form like Base64 or URL percent-encoding (%20).

A quick way to keep them straight: \n is a JSON escape, %0A is URL encoding, and Cg== is Base64. They can all represent a newline, but they belong to different layers. If your goal is to get JSON right, you want escaping. If you are stuffing binary into a JSON field, you encode it (usually Base64) first, then the resulting text needs no special escaping at all.

Escaping JSON inside a string (JSON in JSON)

Sometimes a JSON value is itself a JSON document, a common shape in logs, webhook payloads, and message queues. Now every quote in the inner JSON has to be escaped, because the inner document is just a string to the outer one:

{ "payload": "{\"id\":42,\"ok\":true}" }

The inner {"id":42,"ok":true} becomes {\"id\":42,\"ok\":true}. Nest it one level deeper and the backslashes multiply again (\\\"), which is exactly where hand-editing falls apart. If you understand the underlying JSON syntax rules and how strings are delimited, this stops being mysterious: each layer of nesting escapes the layer inside it. It is the same reason a Windows path needs doubled backslashes, applied recursively.

How to escape a string quickly without doing it by hand

For anything past a quote or two, do not count backslashes yourself. Paste the raw text into our JSON escape and unescape tool and it adds every backslash for you, then reverses it when you need the original back.

If your goal is to check that a full document parses and to see it laid out cleanly, the JSON formatter is the better stop, it will point to the exact line where a stray quote or missing backslash breaks the parse. Escaping is one small piece of the bigger picture, so if you are still nailing down the basics, start with what JSON actually is and the JSON data types that strings live alongside.

FAQ

Which characters must be escaped in JSON?

The double quote (\") and the backslash (\\) always, plus any control character below U+0020, which includes newline (\n), tab (\t), and carriage return (\r). Everything else, including forward slashes and single quotes, can stay as-is.

Do I need to escape the forward slash in JSON?

No. \/ is legal but unnecessary. The only common reason to escape it is to write <\/script> safely when JSON sits inside an HTML page.

How do I escape a double quote in JSON?

Put a backslash in front of it: \". So the sentence He said “hi” becomes "He said \"hi\"" inside a JSON string.

When should I use \uXXXX Unicode escapes?

Use them for invisible or ambiguous characters (like a non-breaking space, \u00a0), or when you need pure-ASCII output for a pipeline that is not UTF-8 safe. For normal accented letters and emoji, raw UTF-8 in the string works fine.