# @tramvai/safe-strings

> Utility kit for a safe string encoding/decoding

Latest version **0.9.4** (published 2026-07-29) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @tramvai/safe-strings
pnpm add @tramvai/safe-strings
yarn add @tramvai/safe-strings
bun add @tramvai/safe-strings
```

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; esm support; no vulnerabilities; high maintenance score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.9.4 |
| Published | 2026-07-29 |
| First published | 2021-09-02 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 2 |
| Unpacked size | 24.1 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 130 |
| Maintainers | super_oleg, meskill, tinkoffbank |

## Links

- npm: https://www.npmjs.com/package/@tramvai/safe-strings
- Repository: https://github.com/tramvaijs/tramvai
- Homepage: https://github.com/tramvaijs/tramvai#readme
- Issues: https://github.com/tramvaijs/tramvai/issues
- npm.io page: https://npm.io/package/@tramvai/safe-strings

## Dependencies (2)

- [tslib](https://npm.io/package/tslib.md) ^2.4.0
- [@tinkoff/utils](https://npm.io/package/@tinkoff/utils.md) ^2.1.3

## Recent versions

- 0.9.4 (latest) — 2026-07-29
- 0.8.9 (stable-v5.x.x) — 2026-07-30
- 0.10.2 (prerelease) — 2026-07-29
- 0.6.8 (stable-v3.x.x) — 2025-01-09
- 0.9.3 — 2026-03-17
- 0.10.1 — 2025-12-26
- 0.9.2 — 2025-12-26
- 0.8.8 — 2025-12-26
- 0.9.1 — 2025-12-18
- 0.8.7 — 2025-12-18
- 0.8.6 — 2025-11-19
- 0.8.5 — 2025-09-23
- 0.9.0 — 2025-09-16
- 0.8.4 — 2024-12-23
- 0.7.9 — 2024-12-19
- … 31 more at https://npm.io/package/@tramvai/safe-strings/versions

## README

# @tramvai/safe-strings

Utility kit for a safe string encoding/decoding

## `safeParseJSON`

Tries to parse json and if it successful returns it, otherwise returns second argument as default value.

## `safeStringify`

Converts object to json with a replacement of insecure symbols that allows to insert result string in the response html

## `safeStringiyfJSON`

Converts object to json with a circular reference handling

## Encoding

Set of utility functions for encoding, mostly for XSS protection

### `encodeForHTMLContext`

String encoding for HTML context - escapes all symbols with possible XSS attack - `<`, `>`, `&`, `'`, `"`

### `encodeForJSContext`

String encoding for JS context - escapes all symbols with possible XSS attack or breaking code - `<`, `>`, `/`, `\u2028`, `\u2029`

### `encodeForURLContext`

String encoding for URL context - escapes all symbols with possible XSS attack or breaking code, removes `javascript:alert('xss')` and other unsafe protocols (`data:`, `vbscript:`)

---
_Source: https://npm.io/package/@tramvai/safe-strings · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._