JSON escape and unescape

How does JSON string escaping work?

RFC 8259, the JSON standard, says every Unicode character may appear inside a JSON string except three kinds, which must be escaped: the double quote, the backslash, and the control characters U+0000 to U+001F. A string starts and ends with a double quote, so an unescaped one would end it early, and the backslash is what starts an escape.

Seven characters have two-character escapes: \" for the quote, \\ for the backslash, and \b, \f, \n, \r and \t for backspace, form feed, line feed, carriage return and tab. Every other control character is written as \u and four hex digits, so U+001F is \u001f. That is exactly what this tool writes by default, and what JavaScript's JSON.stringify writes.

Any other character may be escaped too, but doesn't have to be. A character above U+FFFF is escaped as two \u escapes, the UTF-16 surrogate pair: RFC 8259's example is the G clef U+1D11E, written \ud834\udd1e. The option to escape everything outside printable ASCII is useful when the JSON passes through a system that mangles UTF-8. The forward slash may be written \/, which RFC 8259 allows but doesn't require.

Unescaping reads the text as the inside of a JSON string, with or without its surrounding quotes. It stops at the first thing JSON doesn't allow and says where it is: an escape JSON doesn't have, such as \' or \x41 from JavaScript, \u without four hex digits, an unescaped quote, or a raw line break that should have been \n.

"  →  \"        \  →  \\        /  →  \/  (optional)
backspace \b   form feed \f   line feed \n   carriage return \r   tab \t
other U+0000–U+001F  →  \u0000 … \u001f
U+1D11E  →  \ud834\udd1e  (surrogate pair, optional)