LDAP DN escaper
Smith, John becomes Smith\, John, so the comma stays part of the name instead of splitting the distinguished name. Plus signs, quotes, backslashes, angle brackets and semicolons get the same RFC 4514 treatment, and decoding reverses it. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Smith, John
- Calculation mode
- Encode
- Result
- Smith\, John
- Encoding
- ldap_dn_rfc4514
- Input length
- 11
- Output length
- 12
This LDAP DN escaper converts a plain attribute value into the escaped form required by RFC 4514 string representations of distinguished names, and it reverses the same mapping when you paste an escaped component back into ordinary characters. Encoding rewrites commas, plus signs, double quotes, backslashes, angle brackets, and semicolons so a hand-built common name, organization unit, or filter fragment can sit inside an RDN without splitting the surrounding DN. Leading number signs and leading or trailing ASCII spaces also receive a backslash so directory servers do not treat them as hex markers or insignificant padding. Decoding accepts both the special-character form and two-digit hex pairs such as backslash-two-C for a comma, and it fails loudly on a lone trailing backslash, a half-finished hex digit, or an illegal escape letter so typos never silently survive into bind DNs or migration scripts. The path is fully deterministic: the same text and mode always produce the same result, with no network calls, no random salts, and no date-dependent shortcuts. Small checks include encoding a surname that contains a comma into backslash-comma form, and decoding a quoted nickname that uses backslash-quote pairs back into real quotation marks.
Where LDAP DN escape and unescape fit in developer workflows
Identity and SSO teams encode dynamic display names before placing them inside a relative distinguished name so a single comma or quote cannot break the surrounding string representation. Pipeline authors decode escape-heavy exports from legacy directories so application code works with true commas and spaces instead of literal backslash-comma sequences. Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims RFC 4514 support cannot silently switch to a non-standard escape table between releases.
Educators use the same tool when teaching the difference between a full multi-RDN distinguished name, a single attribute value, and the small set of escapes that the specification allows inside that value.
What you can do with it
Safe RDN attribute values
Escape surnames, OUs, and free-text CN values so commas, plus signs, quotes, and edge spaces cannot break a hand-built or templated distinguished name.
FAQ
What does the LDAP DN escaper cost?
It is free in your browser on this page.
Which characters are escaped on encode?
Encode rewrites comma, plus, double quote, backslash, less-than, greater-than, and semicolon with a backslash prefix; leading hash and leading or trailing ASCII space the same way; and control octets U+0000–U+001F as two-digit hex.
What happens if an escape is incomplete or illegal?
Lone backslashes, half-finished hex pairs, and non-RFC escape letters are rejected.
Is the result deterministic?
Yes. The same text and mode always produce the same result with no network, randomness, or date-dependent behavior.
Why are spaces at the start or end of a value escaped?
Because directory servers treat a leading or trailing space as padding and may drop it, while a backslash keeps it. A number sign at the very start is escaped too, so it is not read as the marker of a hexadecimal value.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/ldap-dn-escape \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Smith, John"}'const res = await fetch("https://api.kit.forhosting.com/enc/ldap-dn-escape", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Smith, John"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/ldap-dn-escape",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Smith, John"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/ldap-dn-escape", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Smith, John"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Smith, John"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/ldap-dn-escape", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Smith, John"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.ldap_dn_escape",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
What RFC 4514 DN component escaping is and what this tool returns
An LDAP distinguished name is a sequence of relative distinguished names, and each RDN pairs an attribute type with a string value. A literal comma must appear as a backslash-comma pair, a literal plus must be backslash-plus, and double quote, backslash, less-than, greater-than, and semicolon follow the same pattern. A number sign at the very start of the value is escaped so it is not read as a hex-string marker, and an ASCII space at the start or end of the value is escaped so it is not dropped as insignificant white space. Control octets below space are written as a reverse solidus and two uppercase hexadecimal digits, matching the portable form used in directory examples and many language bindings. This page implements that encode set on the encode path and the reverse on decode: the response is the component string only, without inventing attribute type names or walking a multi-RDN tree. RFC 4514 defines how that value is written in text so parsers can recover the original octets without mistaking structural separators for payload. The JSON response always includes result for the transformed string, mode echoing encode or decode, encoding fixed to ldap_dn_rfc4514, and input_length plus output_length so tests can assert sizes. Encode also reports escapes_applied and decode reports escapes_resolved so you can confirm how many special characters or escape sequences were rewritten. There is no partial silent skip for a broken sequence: either every backslash pair is legal under RFC 4514 or the request fails with invalid_input.
How text and mode are read and how results stay reproducible
Encode walks the string by UTF-16 code units and replaces only the characters that RFC 4514 requires to be escaped, leaving letters, digits, and ordinary Unicode unchanged so readable names stay readable. Because backslash is rewritten in the same left-to-right pass as commas and quotes, you get a single consistent escaping pass that matches common directory-toolkit tables for attribute values. Decode scans for reverse-solidus sequences: if the next two characters are hexadecimal digits, the pair is treated as one octet; otherwise the next character must be one of the specials space, hash, quote, plus, comma, semicolon, less-than, greater-than, backslash, or equals. The preferred payload field is text, with aliases input, value, s, payload, dn, and component so forms, query strings, and SDK clients can reuse the same contract without renaming columns. Mode defaults to encode and accepts decode explicitly; aliases op, direction, and action map to the same switch for scripts that already use those names, and escape or unescape are accepted as synonyms. An incomplete trailing backslash, a single hex digit without its partner, or any other letter after a backslash raises invalid_input with a message that names the problem. The length ceiling of one hundred thousand characters keeps Worker memory predictable while still covering long multi-valued fragments, sample DNs, and most paste buffers. Pair the free browser run on this page with the priced API when you need the identical mapping inside an automated pipeline without re-implementing RFC 4514 tables yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price at $0.002.
Where LDAP DN escape and unescape fit in developer workflows
On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split—free interactive exploration and a priced, identical API—matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the escaped result. Pair it with URL percent-encoding, JSON string helpers, or shell argument quoters when you need broader text transforms, and with other encoding endpoints when you are building a small lab of free, deterministic tools for CI and documentation.
Integration use cases
LDIF and migration cleanup
Decode RFC 4514 escapes from exports, logs, or golden LDIF files back into plain Unicode for readable diffs and application code.
Deterministic CI pairs
Generate reproducible encode and decode pairs for unit tests, directory middleware contracts, and tools that must match RFC 4514 tables.
Technical questions
What modes are supported?
mode=encode (default) turns plain text into RFC 4514 DN component escapes. mode=decode turns those escapes back into characters.