Why Does My JSON Have Backslashes? — How to Fix Double-Escaped JSON

Seeing "{"name":"Alice"}" instead of {"name":"Alice"}? Your JSON is double-escaped — the JSON has been serialized twice. This is one of the most common API bugs encountered by developers, especially when connecting frontend applications to backend APIs. This guide explains exactly why it happens, how to diagnose it quickly, and how to fix it permanently at the source — or work around it client-side when you can't.

The difference between normal JSON and double-escaped JSON is subtle but critical. When you look at a raw API response or log it to your console, the format reveals the problem immediately.

The telltale signs of double-escaped JSON are: the response body starts and ends with a double quote character, every internal quote is preceded by a backslash (\"), and typeof response === 'string' in JavaScript when you expected an object. In Postman or Chrome DevTools, the Response tab will show the entire body as a quoted string.

The overwhelming majority of double-escaped JSON issues trace back to a single mistake: calling JSON.stringify() on a value that is already a JSON string, or using a framework method that performs automatic serialization on data you've already serialized.

// Backend code — accidentally serializing twice
const user = { name: "Alice", age: 30 };

// First serialization — produces a string
const jsonString = JSON.stringify(user);
// jsonString = '{"name":"Alice","age":30}'

// Second serialization ❌ — serializing the string again
res.json(JSON.stringify(jsonString));
// Client receives: '"{\"name\":\"Alice\"}"'
// Because res.json() runs JSON.stringify() internally,
// wrapping your already-stringified string in another layer of quotes

// Option 1: Pass the object directly to res.json()
// res.json() handles all serialization automatically
const user = { name: "Alice", age: 30 };
res.json(user);  // ✅ Correct — serialized exactly once

// Option 2: If you must build the string manually and send it raw
const jsonString = JSON.stringify(user);
res.setHeader('Content-Type', 'application/json');
res.send(jsonString);  // ✅ send the raw string (already valid JSON)
// Do NOT call res.json() when data is already a string

Python web frameworks have the same trap. The jsonify() function in Flask andJsonResponse in Django both serialize your data automatically. Passing an already-serialized string to them results in double encoding.

import json
from flask import jsonify

user = {"name": "Alice", "age": 30}

# Manually serialize first
json_string = json.dumps(user)          # → '{"name": "Alice", "age": 30}'

# Then pass the string to jsonify ❌
# jsonify() calls json.dumps() on the string again!
return jsonify(json_string)
# Response body: '"{\"name\": \"Alice\", \"age\": 30}"'

from flask import jsonify, Response
import json

user = {"name": "Alice", "age": 30}

# Option 1: Pass dict directly to jsonify ✅
return jsonify(user)

# Option 2: Return raw JSON string with explicit content-type ✅
json_string = json.dumps(user)
return Response(json_string, mimetype='application/json')

AWS API Gateway is a particularly common source of double-escaped JSON because it can apply its own serialization to Lambda return values. Understanding the flow helps you identify where the extra encoding is introduced.

// ❌ Common mistake — returns double-encoded JSON
exports.handler = async (event) => {
  const data = { name: "Alice", age: 30 };
  return {
    statusCode: 200,
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(JSON.stringify(data))  // ❌ double stringify
  };
};

// ✅ Correct — stringify the body once
exports.handler = async (event) => {
  const data = { name: "Alice", age: 30 };
  return {
    statusCode: 200,
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(data)  // ✅ stringify exactly once for the body field
  };
};

Sometimes you're consuming a third-party API or legacy service that you can't modify. In that case, you need to handle double-encoded responses client-side. The approach is straightforward: detect whether the parsed value is a string, and if so, parse again.

// When you receive double-escaped JSON and can't fix the server
const response = await fetch('/api/user');
const data = await response.json();

// data might be a string instead of an object due to double encoding
if (typeof data === 'string') {
  const actualData = JSON.parse(data);  // parse the inner JSON
  console.log(actualData.name);  // "Alice"
} else {
  console.log(data.name);  // already an object — normal case
}

// Generic helper to safely unwrap potentially double-encoded JSON
function unwrapJson(data) {
  if (typeof data === 'string') {
    try {
      return JSON.parse(data);
    } catch {
      return data;  // not JSON, return the string as-is
    }
  }
  return data;
}

// Usage
const raw = await response.json();
const result = unwrapJson(raw);
// result is always an object (or primitive), never a JSON string