Config File Password Encoder
Escape a password correctly for JSON, YAML, TOML, XML, Java .properties, INI, URL connection strings and SQL literals so it is read back unchanged.
Paste the result as the value part of the setting. YAML uses single quotes when possible, TOML a literal string when possible, the URL form percent-encodes every byte except A–Z a–z 0–9 - . _ ~, and SQL doubles single quotes (standard SQL; MySQL with backslash escapes enabled also needs \ doubled).
Runs entirely in your browser. Your data is never uploaded.
What is Config File Password Encoder?
Paste a password and get it correctly escaped for eight configuration formats at once: JSON, YAML, TOML, XML, Java .properties, INI, URL/connection strings and SQL string literals. Each output parses back to exactly the original value.
How to use Config File Password Encoder
- Type the password into the Password field.
- Find the format you need in the list.
- Copy the escaped value with its Copy button.
- Paste it as the value part of your configuration.
Example
p@ss'w"rd$1
JSON "p@ss'w\"rd$1" YAML 'p@ss''w"rd$1' TOML "p@ss'w\"rd$1" XML p@ss'w"rd$1 URL p%40ss%27w%22rd%241 SQL 'p@ss''w"rd$1'
When to use Config File Password Encoder
Use it whenever a secret goes into a config file or connection string by hand. Prefer a secrets manager or environment variables for production secrets.
How Config File Password Encoder works
JSON uses JSON.stringify. YAML uses a single-quoted scalar (with '' for ') unless control characters require a double-quoted one. TOML uses a literal 'string' when possible, otherwise a basic string with \" \\ and \uXXXX escapes. XML escapes & < > " ' and tabs/newlines as character references. .properties escapes \, =, :, #, !, a leading space and non-ASCII as \uXXXX. URL userinfo percent-encodes every byte except A–Z a–z 0–9 - . _ ~. SQL doubles single quotes. INI has no standard escapes, so values with " or line breaks are reported as unsafe.
Common Use Cases
- Putting a password with @ and : into a PostgreSQL or MongoDB connection URL
- Adding a secret to a YAML Kubernetes or Ansible file
- Escaping a password in a Spring application.properties file
- Inserting a test user via a SQL statement
FAQs
Why must passwords be URL-encoded in connection strings?
Characters like @, :, / and # have special meaning in URLs; an unencoded @ makes the parser take part of the password as the host.
Is the SQL literal safe against injection?
It is correct standard SQL escaping, but always prefer parameterized queries in application code.
Why is INI marked as unsafe for some values?
INI has no standard way to escape double quotes or newlines, and parsers differ, so the tool refuses rather than guess.