In a JSON string, two characters must always be escaped — " and \ — plus every control character below U+0020. Everything else (single quotes, slashes, accented letters, emoji) can sit in the string literally. When in doubt, \uXXXX (four hex digits) escapes any BMP character, and a surrogate pair covers the rest.

The escape table

Escape	Produces	Required?
\"	" quote	yes — it ends the string otherwise
\\	\ backslash	yes — it starts an escape otherwise
\/	/	optional (see below)
\b	backspace U+0008	yes (control char)
\f	form feed U+000C	yes (control char)
\n	newline	yes — a literal line break is invalid
\r	carriage return	yes (control char)
\t	tab	yes (control char)
\uXXXX	any code point	required for the other control chars U+0000–U+001F that have no shorthand; optional for everything else

The rule’s source is RFC 8259 §7: a JSON string is a sequence of characters between double quotes, where ", \, and U+0000–U+001F must be escaped. Nothing else is forbidden.

Worked example

value you want:  He said "hi" → C:\new\thing

as JSON:
{ "note": "He said \"hi\" → C:\\new\\thing" }

Every backslash in the value doubles in the JSON; every quote gains a backslash; the arrow and everything else stays literal. Paste it into the formatter and it validates cleanly — a real \ alone would be flagged as an unterminated escape.

The trap: JSON inside JSON

When a JSON document is itself a string value — a webhook payload field, an env var, a row in a text column — it gets escaped a second time:

{"payload": "{\"user\":\"ada\",\"n\":1}"}

The inner document’s quotes all carry backslashes. Seeing \\\" means three layers deep (the \\ decodes to \, then \" decodes to "). If your parsed field still looks like JSON text instead of an object, you have one more JSON.parse to do — or the producer double-serialized, which is the bug behind most “my JSON is full of backslashes” mysteries.

Optional vs forbidden

\/ exists for one historical reason: embedding JSON in an HTML <script> block, where "</script>" inside a string would end the script early. \/ survives everywhere and means /. Meanwhile the genuinely forbidden things are boring but fatal: literal newlines/tabs inside strings, \', \x41-style hex escapes (\x doesn’t exist in JSON), and \u with fewer than four digits. If a file uses \x or \e, it was written by something that isn’t emitting JSON — see the full error catalog for how parsers report each case.

Frequently asked questions

Which characters must be escaped in a JSON string?

Exactly two visible characters: the double quote " and the backslash \ — plus every control character below U+0020 (newline, tab, carriage return and friends), which are forbidden raw. Everything else, including forward slash and all Unicode text, may appear literally.

How do I put a newline inside a JSON string?

As \n — a backslash-n two-character escape, never a literal line break. A real newline inside a JSON string is a syntax error (that's the "unterminated string" or "invalid control character" error). Same family: \t tab, \r carriage return, \r\n for a Windows line ending.

Do I have to escape forward slashes in JSON?

No — \/ is allowed but never required. It exists so JSON can be embedded inside HTML <script> blocks without a </script> in a string ending the block early. Some APIs emit it defensively; both forms decode to the same character.

Why does my JSON have \\ instead of \?

That's a double-encoded string — JSON sitting inside another JSON string. \"a\" as a value means the payload contains the literal characters "a", i.e. it was serialized twice. Decode once and it becomes normal JSON. Common with API payloads, env vars and databases that store JSON-in-JSON.

What's \u0041 — how do Unicode escapes work?

\u plus exactly four hex digits represents one UTF-16 code unit: \u0041 = 'A'. Characters above U+FFFF (emoji, rare CJK) need a surrogate pair — 😀 is \ud83d\ude00. And note \u00e9 and the literal é are the same string; escaping Unicode is optional, not required.

Are single quotes special in JSON?

No — ' never needs escaping (JSON strings are delimited by double quotes only). But a value can't be written in single quotes at all: {'a':1} isn't JSON. That's error #2 in the syntax-error list.