What does JSON unescape actually do?
It walks the input string and replaces every JSON escape sequence with the character it represents: \n becomes a real newline, \t becomes a tab, \" becomes a double quote, \\ becomes a single backslash, and \uXXXX becomes the Unicode code point matching the four hex digits. The output is the raw text that was originally encoded into JSON.
Why does my output still contain backslashes after unescaping?
You almost certainly have a double-stringified payload — the value was JSON-encoded twice. After one unescape pass you still see \n, \", and \\ because the inner string was escaped first, then the whole thing escaped again. Run unescape a second time on the output to reach the original content. APIs that return JSON-as-string fields (common in webhooks and queue messages) produce these.
Should I include the surrounding double quotes when pasting?
Either works. If your input starts with a double quote, the tool treats it as a complete JSON string literal. If it does not, the tool wraps it in quotes before parsing. Both code paths produce the same decoded output for valid escape sequences.
How are \uXXXX Unicode escapes decoded?
JSON.parse converts every four-hex-digit escape to its UTF-16 code unit. Surrogate pairs (used for characters above U+FFFF like emoji) need to appear as two consecutive 🚀-style escapes; the parser combines them into a single emoji. Lone surrogates produce malformed output and may surface as a parse error.
How do I decode a nested-stringified JSON value inside an outer JSON object?
Copy just the string value of the field (between its outer quotes) into the input. The unescape resolves it back to the inner JSON document — which you can then paste into the JSON Formatter or Validator to inspect. This is the typical workflow for log entries that store a JSON event as a string field.
Does this validate that the surrounding JSON is well-formed?
No. This tool decodes a single string scalar. Pass full documents through the JSON Validator to confirm the document parses cleanly and structures match what you expect.
Is my JSON sent to a server?
No. Decoding runs in your browser via the native JSON.parse implementation. Tokens, secrets, and PII embedded in escaped strings never leave the page. Verify in DevTools → Network — no request is fired when you click Run.
What happens if my input contains an invalid escape like \x or \z?
JSON only defines a fixed set of escapes (\" \\ \/ \b \f \n \r \t \uXXXX). Anything else — \x, \z, \a — triggers a parse error and the tool surfaces it. If you are decoding a JavaScript string literal (not JSON), use the JavaScript Unescape tool, which accepts the broader JS escape set.