$ Shell Escape
Paste any string, get it safely quoted for bash / sh, Windows cmd or PowerShell — with a character-by-character view of exactly what changed and why.
✓ 100% client-side — nothing leaves your browser
✓ 5 escape modes
✓ POSIX output verified against real bash & dash
01 · Escape a string
02 · Character-by-character transformation
Every input character and exactly what it becomes in the selected mode. Highlighted rows are the characters that needed escaping.
| Input char | Becomes |
|---|
03 · Command builder
See the escaped string dropped into a real command, ready to paste into your terminal.
04 · Why single-quote mode is the safest
Inside POSIX single quotes, every byte is literal: $, backticks, \, !, spaces and even newlines lose all special meaning — in bash, dash, sh and zsh alike. There is exactly one character you cannot place inside single quotes: the single quote itself. The fix is a three-piece splice:
| Piece | Shell sees | Meaning |
|---|---|---|
| 'it' | quoted it | literal text |
| \' | one ' character | the escaped quote |
| 's' | quoted s | literal text |
Glued together, 'it'\''s' evaluates to exactly it's — the same splice Python's shlex.quote() and PHP's escapeshellarg() produce. No expansion can ever happen, which is why this mode is the default and the only one recommended for untrusted input.
05 · Worked examples
posix-single · the classic
in: it's
out: 'it'\''s'
out: 'it'\''s'
posix-single · hostile mix
in: don't "quote" me $now
out: 'don'\''t "quote" me $now'
out: 'don'\''t "quote" me $now'
posix-single · injection stays literal
in: $(whoami)
out: '$(whoami)'
out: '$(whoami)'
posix-single · multi-line
in: line1
line2
out: 'line1 line2' (newline kept literal)
out: 'line1 line2' (newline kept literal)
posix-backslash · filename
in: file (1).txt
out: file\ \(1\).txt
out: file\ \(1\).txt
posix-double · intentional readability
in: say "hi"
out: "say \"hi\""
out: "say \"hi\""
cmd · percent can never expand
in: 100%
out: "100%%"
out: "100%%"
powershell · quote doubling
in: it's
out: 'it''s'
out: 'it''s'
Every example above is machine-verified: the POSIX outputs round-trip through real bash and dash back to the exact input.
Scope boundary — what this tool is and isn't
✓ This tool
- Escapes one string into one shell-safe argument (one-way: plain → escaped).
- Covers POSIX shells (bash, dash, sh, zsh) plus Windows cmd and PowerShell.
- Shows per-character transformations so you learn the rules, not just copy output.
✕ Not this tool
- Not an unescaper — it never strips quoting back off.
- Not a validator: it assumes you paste the escaped result as a single argument.
- Not a security guarantee — for attacker-controlled input, avoid the shell entirely (argv-style execution).
06 · Frequently asked questions
What is shell escaping and why do I need it?
Shell escaping rewrites an arbitrary string so a shell treats it as one literal argument instead of interpreting its special characters. Without it, a space splits one filename into two arguments, $HOME expands to your home directory, and $(...) or backticks execute commands. Paste the string here, pick the shell you target, and copy the escaped result into your command.
Why is single-quote mode the safest choice for bash and sh?
Inside single quotes, a POSIX shell treats every byte literally: dollar signs, backticks, backslashes, exclamation marks, spaces and newlines all lose their special meaning. The only character you cannot put inside single quotes is a single quote itself, and this tool handles that with the '\'' splice (close the quote, add an escaped quote, reopen). Because nothing is ever expanded, single-quote mode is the only mode that is unconditionally safe for untrusted input.
How do I escape a single quote inside a single-quoted string?
You cannot backslash-escape a quote inside single quotes, so you end the quoted section, emit one escaped quote, and start quoting again. The classic example: it's becomes 'it'\''s'. Read it as three glued pieces: 'it' then \' (one literal quote) then 's'. The shell concatenates them back into it's. This exact splice is what Python's shlex.quote and PHP's escapeshellarg produce.
Why shouldn't I use double quotes for untrusted input?
Because double quotes still expand $variables, $(commands) and `backticks`, escaping them correctly means remembering every special character, and one forgotten character is a command-injection hole. Double-quote mode also cannot represent ! safely: in interactive bash an unescaped ! may trigger history expansion, while an escaped \! keeps its backslash inside scripts. Use double-quote mode only when you deliberately want some expansion to happen, never for untrusted input.
What is the difference between single-quote, backslash and double-quote escaping?
Single-quote mode wraps everything in '...' and splices embedded quotes; it is the safest and works in every POSIX shell including dash. Backslash mode prefixes each special character with a backslash (like bash printf %q); it is compact and readable but cannot represent a literal newline, since backslash-newline means line continuation. Double-quote mode keeps the string readable and allows intentional $expansion, but is the weakest against hostile input. The comparison tab shows all three side by side for your exact input.
How do I escape a string for Windows cmd?
cmd.exe has completely different rules: arguments are wrapped in double quotes, every % is doubled to %% so %PATH% can never expand into an environment variable, and an embedded double quote is written as \" following the C runtime convention most Windows programs use. Characters like & | < > are literal inside the quotes and need no escaping. This tool's cmd mode applies exactly those rules.
How do I escape a string for PowerShell?
In PowerShell, single-quoted strings are fully literal: $variables and `backticks` are never expanded inside them. The only character that needs handling is the single quote itself, which is written as two single quotes (''). So it's becomes 'it''s'. This tool's PowerShell mode applies exactly that rule.
Does escaping a string prevent command injection?
Escaping helps, but it is not a complete security boundary. It is only safe if the escaped value is used as exactly one argument and you never concatenate it with other shell syntax. The strongest defense is to avoid the shell entirely: pass arguments as an array (subprocess without shell=True, execFile/spawn in Node, ProcessBuilder in Java) so no parsing happens at all. Treat this tool as a correctness aid for commands you write by hand, not as a security guarantee for code that processes attacker input.
Is my input sent to a server?
No. This page runs 100 percent in your browser: the escaping engine is plain JavaScript with no network requests, no cookies and no analytics on your input. You can disconnect from the internet and it keeps working. Nothing you paste ever leaves your device.
Shell Escape · free online tool · runs 100% in your browser · no input ever leaves your device.
Free tool by NRTechStudio