Escape regex special characters for a literal match
Make any text safe to drop into a regular expression: invoice.total [draft]? becomes invoice\.total \[draft\]\?, so the period, brackets and question mark match themselves instead of acting as instructions. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Literal text cannot always be inserted directly into a regular expression. Characters such as a period, question mark, bracket, or backslash are instructions in regex syntax, so an unescaped value can match the wrong text or even make the pattern invalid. This capability converts a string into an ECMAScript pattern fragment that treats every regex metacharacter literally. It is useful when search terms, filenames, identifiers, labels, or other user-provided values must become part of a larger regular expression without changing their meaning.
Turn literal text into a safe pattern fragment
Send the exact value you want a regular expression to match in the text field. The result contains escaped, a pattern fragment in which every ECMAScript regex metacharacter has a preceding backslash. Ordinary letters, digits, spaces, punctuation without regex meaning, line breaks, and Unicode characters remain unchanged.
For example, a period normally means any character in a regular expression, while an escaped period means an actual full stop. Parentheses normally create a group, square brackets open a character class, braces can introduce a repetition count, and question marks or asterisks control repetition. Escaping those symbols preserves the literal meaning of the original value.
The returned fragment does not include slash delimiters or flags, so it can be passed directly to a RegExp constructor, embedded in a larger pattern, or stored as a pattern body. An empty input string is valid and produces an empty escaped value because there are no characters to transform.
Compose the escaped value with deliberate regex syntax
Escaping is most useful when part of a pattern comes from data and another part is intentionally written as regex syntax. Suppose an application needs to find a user-supplied product code only at the beginning of a line. Escape the product code first, then add the start anchor and any deliberate boundary logic yourself.
This separation keeps trusted pattern structure distinct from literal content. Do not escape an entire pattern after composing it, because doing so would also neutralize the anchors, groups, alternatives, or quantifiers you intended to keep active. The output targets an ECMAScript pattern body rather than JavaScript source-code notation.
That distinction matters: slash characters are not special to the RegExp constructor and therefore are preserved. If you place the result inside a slash-delimited regex literal in generated JavaScript source, source-level delimiter escaping is a separate concern. In ordinary application code, prefer passing the returned escaped string to new RegExp along with separately selected flags.
Know the guarantee and validate the surrounding design
The transformation is deterministic and linear: it scans the supplied string and prefixes the characters that control ECMAScript regular-expression syntax. It does not use a network, execute the resulting expression, choose flags, add anchors, or decide whether matching should be case-sensitive. Those choices belong to the surrounding application because they change matching behavior rather than literal safety.
Each of those formats has its own escaping rules, and combining them with regex escaping requires applying each layer at the correct boundary. After composition, test the complete pattern against representative positive and negative examples, especially when adding optional sections or alternation around the escaped fragment.
What you can do with it
Build a literal search
Convert a search term into a regex-safe fragment before adding intentional anchors or flags.
Match filenames and identifiers
Preserve periods, brackets, parentheses, plus signs, and other syntax characters in exact values.
Protect dynamic pattern composition
Keep user-provided text literal while trusted application code supplies the surrounding regex structure.
FAQ
Which characters are escaped?
The output escapes backslash, caret, dollar sign, period, vertical bar, question mark, asterisk, plus sign, parentheses, square brackets, and curly braces.
Does the output include regex delimiters?
No. The escaped value is an ECMAScript pattern body or fragment without surrounding slash characters.
Why is a slash not escaped?
A slash is not special inside an ECMAScript pattern passed to the RegExp constructor. Escaping a source-code regex delimiter is a separate JavaScript source-generation task.
Can I add anchors or flags?
Yes. Add deliberate regex syntax around the escaped fragment and provide flags separately when constructing the complete regular expression.
What happens with an empty string?
It is accepted and returns an empty escaped value, which represents a zero-length literal.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev2/regex-special-char-escape \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"invoice.total (USD) [draft]?"}'const res = await fetch("https://api.kit.forhosting.com/dev2/regex-special-char-escape", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "invoice.total (USD) [draft]?"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev2/regex-special-char-escape",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "invoice.total (USD) [draft]?"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev2/regex-special-char-escape", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"invoice.total (USD) [draft]?"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"invoice.total (USD) [draft]?"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev2/regex-special-char-escape", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "invoice.total (USD) [draft]?"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev2.regex_special_char_escape",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Know the guarantee and validate the surrounding design
The capability also does not quote a value for a programming-language string literal, JSON document, shell command, HTML attribute, or URL. Non-string input is rejected with an invalid_input error instead of being coerced, preventing values such as numbers, arrays, objects, null, or booleans from silently becoming surprising pattern text. API requests use the published base price of $0.002.
Technical questions
What happens if text is not a string?
The request fails with an invalid_input error. Values are not converted implicitly.
What does an API request cost?
The API base price is $0.002 per request, and the same deterministic operation can run in the browser.