Why must `"` and `\` always be escaped in JSON strings?
A JSON string is delimited by a pair of double quotes. An unescaped " inside the string would close it prematurely, leaving the parser to choke on the rest. The backslash is the escape lead-in itself, so it must be doubled (\\) to represent a literal backslash. RFC 8259 lists these two characters as the only "must-escape" characters apart from the U+0000–U+001F range.
Are control characters below 0x20 always escaped?
Yes. RFC 8259 §7 forbids any unescaped character in the range U+0000 to U+001F inside a JSON string. Six of them have shortcuts (\b \t \n \f \r and the implicit ", \), and every other control character must be written as \u00XX. JSON.stringify enforces this automatically.
Why are there no comments allowed inside JSON strings?
JSON has no comment syntax at all — not inside strings, not between members. Inside a string the // and /* sequences are simply two literal characters; outside a string they are a parse error. If you need to ship comments, use JSON5, JSONC, or store the comment as a real key like "_comment".
Does it escape forward slash (/)?
RFC 8259 permits but does not require \/ — a forward slash is legal inside a JSON string with or without a backslash. JSON.stringify does not escape it. The escaped \/ form exists only so a JSON document can be safely embedded inside an HTML <script> tag without producing the </ sequence that would close the script element.
Does it add the surrounding double quotes?
Yes. The output is a complete JSON string literal — opening quote, escaped content, closing quote — so you can paste it directly into a JSON document or a JavaScript source file. This matches JSON.stringify("...") behaviour. Strip the outer quotes if you need only the escaped content.
How does this differ from a JavaScript string escape?
JSON is a strict subset of JavaScript string syntax. The big differences: JSON does not allow single-quoted strings, has no \xNN hex escapes, no \u{...} extended Unicode, no octal escapes, no template literals, and no line continuations. A JS-escaped string may not be valid JSON; a JSON-escaped string is always valid JS.
Will JSON.parse round-trip the escaped output?
Yes. JSON.parse(JSON.stringify(s)) === s for any string s — that is the formal guarantee of RFC 8259 plus the ECMAScript specification. The escape preserves every code point exactly, including astral plane characters that are stored as surrogate pair \u escapes.
Is the input sent to your servers?
No. Escaping runs entirely in your browser using JSON.stringify. Strings containing tokens, secrets, customer data, or proprietary content never leave your device. Open DevTools → Network and click Run to verify no requests are made.