Shell argument quoter
hello world becomes 'hello world', a single safe shell argument: spaces, quotes, asterisks and other special signs are wrapped in single quotes so the shell passes them on as plain data. The reverse turns a quoted word back into the original text. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- hello world
- Calculation mode
- Encode
- Result
- 'hello world'
- Encoding
- posix_shell
- Input length
- 11
- Output length
- 13
This shell argument quoter converts plain text into a form that is safe to paste as a single POSIX shell argument, and it reverses the same mapping when you need the original string back from quoted shell syntax. Encoding follows the familiar single-quote convention used by tools like shlex.quote: empty input becomes a pair of empty single quotes, tokens made only of letters digits and a small set of safe punctuation stay bare, and everything else is wrapped in single quotes with each embedded apostrophe rewritten as end-quote, escaped-quote, re-open-quote so the shell never sees an unclosed string. Decoding walks one argv word through single quotes, double quotes with the limited POSIX escape set, and unquoted backslash escapes, and it fails loudly on unterminated quotes, a trailing backslash, or unquoted whitespace so a half-copied command fragment never silently becomes the wrong path. The path is fully deterministic: the same text and mode always produce the same result, with no network calls, no random salts, and no date-dependent shortcuts. Small checks include quoting a path with spaces into single quotes, embedding an apostrophe inside a quoted word, and rejecting a double-quoted fragment that never closes.
What POSIX shell quoting is and what this tool returns
A POSIX shell splits a command line into words and applies quoting rules before a program ever sees argv. Spaces, tabs, and newlines separate words unless they sit inside quotes. Single quotes pass every character through literally until the next single quote, which is why the classic safe recipe is to wrap the whole string and splice each internal apostrophe as a four-character break that leaves the quote closed, emits a literal apostrophe, and reopens the quote.
Double quotes allow a smaller escape set for dollar, backtick, double quote, backslash, and newline, which is useful when you are reading legacy snippets but is not the preferred encode path on this page. Metacharacters such as asterisk, question mark, pipe, ampersand, semicolon, and redirection operators change shell grammar when they appear unquoted; wrapping them in single quotes turns them into ordinary data for the receiving program.
This landing implements that encode set on the encode path and a careful reverse on decode: the response is one argument only, without expanding variables, running globs, or splitting a full pipeline into many words.
What you can do with it
Safe paths in shell snippets
Quote file paths and values with spaces, quotes, or metacharacters before pasting them into POSIX shell scripts, ssh remote commands, or docker run lines.
CI and contract tests
Generate deterministic quote and unquote pairs so pipelines assert the same POSIX-safe form across languages and releases.
FAQ
How do I quote a string for a POSIX shell argument?
Send the plain string in text with mode encode (the default). Empty input becomes '', safe bare tokens stay unquoted, and everything else is single-quoted with '\'' for each apostrophe.
How do I unquote a shell-quoted argument?
Send the quoted word in text with mode decode.
Does this execute shell commands?
No. It only transforms text for safe argv use. It does not spawn a shell, expand variables or globs, or split a full command line into multiple words.
How is an apostrophe inside the text handled?
Inside single quotes an apostrophe cannot be escaped, so the tool closes the quote, adds a backslash-escaped apostrophe and opens the quote again. The four characters '\'' keep the argument whole and the shell sees one literal apostrophe.
Why does unquoting fail on some fragments?
Because the result must be exactly one argument. A quote that is never closed, a backslash at the very end or a space outside quotes means the fragment was cut or holds several words, so the tool stops instead of guessing a wrong path.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/shell-escape \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"hello world"}'const res = await fetch("https://api.kit.forhosting.com/enc/shell-escape", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "hello world"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/shell-escape",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "hello world"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/shell-escape", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"hello world"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"hello world"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/shell-escape", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "hello world"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.shell_escape",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
What POSIX shell quoting is and what this tool returns
The JSON response always includes result for the transformed string, mode echoing encode or decode, encoding fixed to posix_shell, and input_length plus output_length so tests can assert sizes. Encode also reports needs_quotes and apostrophes_escaped; decode reports quote_segments so you can confirm how many quoted regions were consumed. There is no partial silent skip for a broken quote: either the word is well-formed shell quoting or the request fails with invalid_input.
How text and mode are read and how results stay reproducible
Encode classifies the string: empty becomes a pair of empty single quotes; a token matching the safe bare set of letters, digits, and at-sign percent plus equals colon comma period slash underscore hyphen is returned unchanged because it needs no protection; any other character including space, quote, or shell metacharacter forces a full single-quote wrap with the apostrophe splice for each internal single quote. Because the wrap is applied in one left-to-right pass, you get a single consistent quoting form that matches the spirit of shlex.quote and common shell helpers. Decode scans for single-quoted segments, double-quoted segments with the POSIX limited escape set, and unquoted backslash escapes that protect the next character or continue a line when the next character is a newline. The preferred payload field is text, with aliases input, value, s, payload, and arg so forms, query strings, and SDK clients can reuse the same contract without renaming columns. Mode defaults to encode and accepts decode explicitly; aliases op, direction, and action map to the same switch for scripts that already use those names, and quote or unquote are accepted as synonyms. An incomplete trailing backslash, an unclosed single or double quote, or unquoted whitespace that would start a second argv word raises invalid_input with a message that names the problem. The length ceiling of one hundred thousand characters keeps Worker memory predictable while still covering long paths, environment values, and most paste buffers. Pair the free browser run on this page with the priced API when you need the identical mapping inside an automated pipeline without re-implementing shell quoting tables yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price at $0.002.
Where shell argument quoting fits in developer workflows
Developers meet shell argument quoting when they build remote commands, write installation snippets, assemble docker or ssh argument lists, or store file paths that may contain spaces and apostrophes. Frontend and backend teams encode user-supplied file names before embedding them in a shell template so a single space or quote cannot break the surrounding command or inject extra tokens. Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims shell-safe quoting cannot silently switch to a non-POSIX table between releases. Educators use the same tool when teaching the difference between single quotes, double quotes, backslash escapes, and why empty arguments must still appear as a pair of quotes rather than vanish. Security reviewers use quote checks as a hygiene step before pasting values into shell scripts, remembering that quoting is not a substitute for avoiding shell when a direct argv array API is available. On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split—free interactive exploration and a priced, identical API—matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the quoted result. Pair it with JSON string escape or URL percent-encoding when you need broader text transforms, and with other encoding endpoints when you are building a small lab of free, deterministic tools for CI and documentation.
Integration use cases
Fixture and log cleanup
Unquote shell-quoted fragments from logs, runbooks, or golden files back into plain Unicode for readable diffs and application code.
Technical questions
What counts as malformed quoting?
Unterminated single or double quotes, a trailing backslash at end of input, and unquoted whitespace (which would start a second argv word) all fail with invalid_input and are not billed.
What does the shell argument quoter cost?
The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.