Escape JSON in Java — Jackson, Gson, and When Raw Strings Win

Java JSON work in 2026 is split between Jackson (the dominant choice) and Gson (Google's library). Both handle escape rules correctly. The pain in Java is less about the libraries and more about embedding JSON as string literals in source code — something Java 15+ text blocks finally solved.

Jackson — writeValueAsString Handles Escaping

Jackson's ObjectMapper serializes objects to JSON strings with proper escaping:

import com.fasterxml.jackson.databind.ObjectMapper;

ObjectMapper mapper = new ObjectMapper();
Map<String, Object> data = Map.of(
    "name", "Alex",
    "quote", "She said \"hi\""
);
String json = mapper.writeValueAsString(data);
// {"name":"Alex","quote":"She said \"hi\""}

Every required escape is applied. Jackson does not HTML-escape by default (unlike System.Text.Json in .NET) — the output is compact and readable.

If you need HTML-safe output, add the JsonFactory.Feature.ESCAPE_NON_ASCII flag or use a custom CharacterEscapes implementation. Most projects don't need this.

Gson — toJson Handles Escaping

Gson's API is similar:

import com.google.gson.Gson;

Gson gson = new Gson();
Map<String, Object> data = Map.of(
    "name", "Alex",
    "html", "<b>bold</b>"
);
String json = gson.toJson(data);
// {"name":"Alex","html":"\u003cb\u003ebold\u003c/b\u003e"}

Gson HTML-escapes by default (unlike Jackson). To disable:

Gson gson = new GsonBuilder().disableHtmlEscaping().create();

With HTML escaping off, Gson's output matches Jackson's compact style. Same bytes semantically; just readable instead of \u003c-peppered.

Sell Custom Apparel — We Handle Printing & Free Shipping

Java 15+ Text Blocks for Embedded JSON

The old way to embed a JSON string literal in Java was pain:

String json = "{\"name\": \"Alex\", \"active\": true}";

Every double quote needs to be escaped, and the line is unreadable. Java 15 introduced text blocks that sidestep this entirely:

String json = """
    {"name": "Alex", "active": true}
    """;

Double quotes inside text blocks are literal — no escaping needed. For multi-line JSON:

String config = """
    {
        "host": "localhost",
        "port": 5432,
        "ssl": true
    }
    """;

For any project on Java 15+, text blocks are the right way to embed JSON literals. Older Java versions are stuck with escape-heavy string concatenation — use a library or an external file instead.

Escaping a Single String Without Full Serialization

Sometimes you have a String value and want its JSON-escaped representation (without a full object). Jackson:

String input = "She said \"hi\"";
String escaped = mapper.writeValueAsString(input);
// "She said \"hi\""

The result includes the surrounding quotes. Strip them if you need just the inner content:

String inner = escaped.substring(1, escaped.length() - 1);

Gson is similar: gson.toJson(inputString). Both pay the cost of the library being loaded but are the safest way to escape — they follow every spec rule.

Do not roll your own string-replace escape function. Hand-written escape loops miss edge cases (control characters below U+0020, unicode surrogate pairs) and ship bugs that show up months later with specific user input.

Reading Escaped JSON Back

Both libraries unescape on parse:

// Jackson
MyType obj = mapper.readValue(jsonString, MyType.class);

// Gson
MyType obj2 = gson.fromJson(jsonString, MyType.class);

If the JSON string itself was double-escaped (stored as JSON inside a JSON string), call parse twice. Signs of double-escape: backslash sequences like \\" appearing inside what should be a parsed value. Our online escape tool handles one-off unescape faster than spinning up a Java process.

Frequently Asked Questions

Why does Gson escape my HTML characters?

Default is HTML-safe. Call disableHtmlEscaping() on the GsonBuilder to opt out.

Is Jackson faster than Gson?

Generally yes, especially for streaming and large documents. For small-to-medium objects the difference is negligible.

How do I escape a string for JSON without a library?

Possible but fragile — you have to handle all control characters and surrogate pairs correctly. Use a library; ObjectMapper is already on the classpath of most Java projects.

Do text blocks support variable interpolation?

No, but you can use String.format or formatted() method. For JSON templates, consider a templating library or build the object and serialize.