Regex metacharacter escaper
Paste file.txt (v1.0+) and get file\.txt \(v1\.0\+\): every dot, bracket, plus sign and other regex operator gets a backslash, so the pattern matches your text character for character. The reverse option recovers plain text. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- file.txt (v1.0+)
- Calculation mode
- Escape
- Result
- file\.txt \(v1\.0\+\)
- Length
- 21
- Input length
- 16
- Escaped count
- 5
Regular expressions treat dots, stars, brackets, and parentheses as operators rather than ordinary characters. Paste a file name like report.v2.pdf into a pattern without escaping and the dots suddenly mean “any character,” so the match silently expands beyond the intended name. Product codes, email local parts, shell globs copied into search boxes, and user-typed filters all carry the same risk. This capability walks every character, prefixes each JavaScript and PCRE-style metacharacter with a backslash, and returns a fragment you can drop into a larger pattern knowing it will match the original string character for character. The reverse path unescapes a pure literal pattern so you can recover the plain text behind \. and \( sequences.
Which characters need escaping and why
A regular expression engine reads some symbols as syntax rather than data. The classic set that must be escaped for a literal match in JavaScript RegExp constructors and in PCRE-style engines includes the period, star, plus, question mark, caret, dollar, curly braces, parentheses, vertical bar, square brackets, and the backslash itself. Without a leading backslash, a period matches any single character, a star repeats the previous atom, parentheses open a capturing group, and a caret or dollar anchors the match.
When you only want the user’s product SKU, file path, or error message to appear exactly as typed, every one of those symbols has to become data again. This capability prefixes each of them with a single backslash on the escape path: file.txt becomes file\.txt, and a version tag such as (v1.0+) becomes \(v1\.0\+\). Letters, digits, spaces, and most punctuation outside that set pass through unchanged.
Where literal regex escaping shows up in real work
Search and filter UIs often wrap user input in a dynamic pattern so partial matches highlight in a table; escaping first prevents a single parenthesis from throwing a syntax error or opening an unintended group. Log triage tools turn a copied error line into a search pattern that must not treat dots in host names or version numbers as wildcards. Security reviewers convert a suspicious string into a literal fragment before embedding it in a larger allow-list expression so metacharacters cannot widen the match.
Localization and content pipelines sometimes store already-escaped fragments; unescaping recovers the human-readable token for display without reintroducing active syntax. Programming courses use a live escaper to show why “any character” and “the character period” are not the same idea in a regex lesson. If you need to run matches and replacements, explain an existing pattern in prose, generate a pattern from a description, or percent-encode a URL, those are separate search intents and landings—this page is only for literal metacharacter escape and unescape.
What you can do with it
Safe user filters in search UIs
Escape whatever the user types before wrapping it in a dynamic regex so dots and parentheses never become operators or syntax errors.
FAQ
Which metacharacters does this tool escape?
The JavaScript / PCRE-style literal set: . * + ? ^ $ { } ( ) | [ ] and the backslash. Each is prefixed with \ so the fragment matches the original characters exactly.
What happens on bad input?
Missing text, unknown mode, oversized strings, a trailing backslash, non-meta escapes such as \d, and bare metacharacters on the unescape path are all rejected. Validation failures are not charged.
Does this run or test a regular expression?
No. It only escapes and unescapes for literal matching. Use a dedicated regex tester if you need match, replace, or group capture results.
What does it cost?
The browser tool is free and runs locally.
Why does an unescaped dot match more than I typed?
In a regular expression a dot means any single character, so report.v2.pdf would also match names with other characters in those places. Escaping turns each dot back into a real period, and the match stays exactly on the text you meant.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/regex-escape \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"file.txt (v1.0)"}'const res = await fetch("https://api.kit.forhosting.com/enc/regex-escape", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "file.txt (v1.0)"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/regex-escape",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "file.txt (v1.0)"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/regex-escape", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"file.txt (v1.0)"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"file.txt (v1.0)"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/regex-escape", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "file.txt (v1.0)"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.regex_escape",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
The free browser tool and the paid API share one deterministic core at the published price of $0.002 per successful item.
What you send and what you get back
Send a required string field named text and an optional mode field set to escape or unescape. Escape walks the input, counts how many metacharacters were prefixed, and returns result as the primary safe pattern fragment. When mode is omitted, escape is the default so a single payload still does useful work. Aliases such as encode and decode are accepted for teams already wired to other encoding tools in the catalog. Unescape reverses only pure literal patterns: a backslash must be followed by a metacharacter or another backslash; a trailing lone backslash, an escape such as \d or \n that is not part of the literal set, or a bare metacharacter that was never escaped all fail with invalid_input and an English message that names the index. Success responses echo mode and the original text, include length and input_length, report escaped_count, list the unique metacharacters that were touched in sorted order, and attach a short standard label naming the JavaScript and PCRE-style rule set. Missing text, unsupported mode values, and strings longer than the documented maximum also fail without consuming prepaid balance. Pricing for successful API calls is the published base of $0.002 per item.
Where literal regex escaping shows up in real work
Because this capability is a pure parse engine, API pricing stays at the published base of $0.002 per successful item and failed validation does not consume balance.
Integration use cases
Stable CI golden patterns
Convert file names and error strings into literal-safe fragments that tests can embed without hand-maintained backslash noise.
Recover plain text from fixtures
Unescape a pure literal pattern stored in a config file to show the original product code or path in admin tools.
Technical questions
Can I convert both ways?
Yes. mode=escape (default, also accepts encode) turns plain text into a literal-safe pattern; mode=unescape (also accepts decode) reverses a pure literal pattern back to plain text.