UTF-8

UTF-8 (8-bit Unicode Transformation Format) is a variable-length character encoding for Unicode. Like UTF-16 and UTF-32, UTF-8 can represent every character in the Unicode character set, but unlike them it has the special property of being backwards-compatible with ASCII. For this reason, it is steadily becoming the dominant character encoding for files, e-mail, web pages,^[1][2] and other software that manipulates textual information.

UTF-8 encodes each character (code point) in 1 to 4 octets (8-bit bytes); and encodes the first 128 characters of the Unicode character set (which correspond directly to the ASCII character set) using a single octet with the same binary value as in ASCII.

The Internet Engineering Task Force (IETF) requires all Internet protocols to identify the encoding used for character data, and the supported character encodings must include UTF-8.^[3] The Internet Mail Consortium (IMC) recommends that all e-mail programs be able to display and create mail using UTF-8.^[4]

History

By early 1992 the search was on for a good byte-stream encoding of multi-byte character sets. The draft ISO 10646 standard contained a non-required annex called UTF that provided a byte-stream encoding of its 32-bit code points. This encoding was not satisfactory on performance grounds, but did introduce the notion that bytes in the ASCII range of 0–127 represent themselves in UTF, thereby providing backward compatibility.

In July 1992, the X/Open committee XoJIG was looking for a better encoding. Dave Prosser of Unix System Laboratories submitted a proposal for one that had faster implementation characteristics and introduced the improvement that 7-bit ASCII characters would only represent themselves; all multibyte sequences would include only bytes where the high bit was set.

In August 1992, this proposal was circulated by an IBM X/Open representative to interested parties. Ken Thompson of the Plan 9 operating system group at Bell Labs, then made a crucial modification to the encoding to allow it to be self-synchronizing, meaning that it was not necessary to read from the beginning of the string to find code point boundaries. Thompson's design was outlined on September 2, 1992, on a placemat in a New Jersey diner with Rob Pike. The following days, Pike and Thompson implemented it and updated Plan 9 to use it throughout, and then communicated their success back to X/Open.^[5]

UTF-8 was first officially presented at the USENIX conference in San Diego, from January 25–29, 1993.

Description

The UTF-8 encoding is variable-width, with each character represented by 1 to 4 bytes. Each byte has 0–4 leading consecutive '1' bits followed by a '0' bit to indicate its type. 2 or more '1' bits indicates the first byte in a sequence of that many bytes. The scalar value of the Unicode code point is the concatenation of the non-control bits. In this table, zeros and ones in black represent control bits, each x represents one of the lowest 8 bits of the Unicode value, y represents the next higher 8 bits, and z represents the bits higher than that.

So the first 128 characters (US-ASCII) need one byte. The next 1,920 characters need two bytes to encode. This includes Latin letters with diacritics and characters from Greek, Cyrillic, Coptic, Armenian, Hebrew, Arabic, Syriac and Tāna alphabets. Three bytes are needed for the rest of the Basic Multilingual Plane (which contains virtually all characters in common use). Four bytes are needed for characters in the other planes of Unicode, which include less common CJK characters and various historic scripts.

By continuing the pattern given above it is possible to deal with much larger numbers. The original specification allowed for sequences of up to six bytes covering numbers up to 31 bits (the original limit of the Universal Character Set). However, UTF-8 was restricted by RFC 3629 (Note: IETF doesn't define UTF-8, Unicode does) to use only the area covered by the formal Unicode definition, U+0000 to U+10FFFF, in November 2003.

With these restrictions, bytes in a UTF-8 sequence have the following meanings. The ones marked in red can never appear in a legal UTF-8 sequence. The ones in green are represented in a single byte. The ones in blue must only appear as the first byte in a multi-byte sequence, and the ones in orange can only appear as the second or later byte in a multi-byte sequence:

Invalid byte sequences

Not all sequences of bytes are valid UTF-8. A UTF-8 decoder should be prepared for:

• the red invalid bytes in the above table
• an unexpected continuation byte
• a start byte not followed by enough continuation bytes
• a sequence that decodes to a value that should use a shorter sequence (an "overlong form").

Many earlier decoders would happily try to decode these. Carefully crafted invalid UTF-8 could make them either skip or create ASCII characters such as NUL, slash, or quotes. Invalid UTF-8 has been used to bypass security validations in high profile products including Microsoft's IIS web server.^[6]

RFC 3629 states "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."^[7] The Unicode Standard requires decoders to "...treat any ill-formed code unit sequence as an error condition. This guarantees that it will neither interpret nor emit an ill-formed code unit sequence." Many UTF-8 decoders throw an exception if a string has an error in it. One example was Python 3.0 which would exit immediately if the command line had invalid UTF-8 in it.^[8] In some cases, though, being unable to work with data means you cannot even try to fix it. Another option is to translate the first byte to a replacement and continue parsing with the next byte. Popular replacements are:

• The replacement character '�' (U+FFFD)
• The '?' or '¿' character (U+003F or U+00BF)
• The invalid Unicode code points U+DC80..U+DCFF where the low 8 bits are the byte's value.
• Interpret the bytes according to another encoding (often ISO-8859-1 or CP1252).

Replacing errors is "lossy": more than one UTF-8 string converts to the same Unicode result. Therefore the original UTF-8 should be stored, and translation should only be used when displaying the text to the user.

Invalid code points

UTF-8 may only legally be used to encode valid Unicode scalar values. According to the Unicode standard the high and low surrogate halves used by UTF-16 (U+D800 through U+DFFF) and values above U+10FFFF are not legal Unicode values, and the UTF-8 encoding of them is an invalid byte sequence and should be treated as described above.

Whether an actual application should do this with surrogate halves is questionable. Allowing them allows lossless storage of invalid UTF-16, and allows CESU encoding (described below) to be decoded. There are other code points that are far more important to detect and reject, such as the reversed-BOM U+FFFE, or the C1 controls, caused by improper conversion of CP1252 text or double-encoding of UTF-8. These are invalid in HTML.

Official name and incorrect variants

The official name is "UTF-8". All letters are upper-case, and the name is hyphenated. This spelling is used in all the documents relating to the encoding.

Alternatively, the name "utf-8" may be used by all standards conforming to the Internet Assigned Numbers Authority (IANA) list^[9] (which include CSS, HTML, XML, and HTTP headers)^[10], as the declaration is case insensitive.

Other descriptions that omit the hyphen or replace it with a space, such as "utf8" or "UTF 8", are not accepted as correct by any standard. Despite this, most agents such as browsers can understand them.

UTF-8 derivations

The following implementations are slight differences from the UTF-8 specification. They are incompatible with the UTF-8 specification.

CESU-8

Many pieces of software added UTF-8 conversions for UCS-2 data and did not alter their UTF-8 conversion when UCS-2 was replaced with the surrogate-pair supporting UTF-16. The result is that each half of a UTF-16 surrogate pair is encoded as its own 3-byte UTF-8 encoding, resulting in 6 bytes rather than 4 for characters outside the Basic Multilingual Plane. Oracle databases use this, as well as Java and Tcl as described below, and probably a great deal of other Windows software where the programmers were unaware of the complexities of UTF-16. Although most usage is by accident, a supposed benefit is that this preserves UTF-16 binary sorting order when CESU-8 is binary sorted.

Modified UTF-8

In Modified UTF-8^[11] the null character (U+0000) is encoded as 0xC0,0x80, this is not valid UTF-8^[12] because it is not the shortest possible representation. Modified UTF-8 strings will never contain any null bytes,^[13] which allows them (with a null byte added to the end) to be processed by the traditional ASCIIZ string functions, yet allows all Unicode values including U+0000 to be in the string.

All known Modified UTF-8 implementations also treat the surrogate pairs as in CESU-8.

In normal usage, the Java programming language supports standard UTF-8 when reading and writing strings through InputStreamReader and OutputStreamWriter. However it uses Modified UTF-8 for object serialization,^[14] for the Java Native Interface,^[15] and for embedding constant strings in class files.^[16] Tcl also uses the same modified UTF-8^[17] as Java for internal representation of Unicode data but uses strict CESU-8 for external data.

Byte order mark

Many Windows programs (including Windows Notepad) add the bytes 0xEF, 0xBB, 0xBF at the start of any document saved as UTF-8. This is the UTF-8 encoding of the Unicode byte order mark (BOM), and is commonly referred to as a UTF-8 BOM even though it is not relevant to byte order. The BOM can also appear if another encoding with a BOM is translated to UTF-8 without stripping it.

The presence of the UTF-8 BOM may cause interoperability problems with existing software that could otherwise handle UTF-8, for example:

• Older text editors may display the BOM as "" at the start of the document, even if the UTF-8 file contains only ASCII and would otherwise display correctly.
• Programming language parsers can often handle UTF-8 in string constants and comments, but cannot parse the BOM at the start of the file.
• Programs that identify file types by leading characters may fail to identify the file if a BOM is present even if the user of the file could skip the BOM. Or conversely they will identify the file when the user cannot handle the BOM. An example is the Unix shebang syntax.
• Programs that insert information at the start of a file will result in a file with the BOM somewhere in the middle of it (this is also a problem with the UTF-16 BOM). One example is offline browsers that add the originating URL to the start of the file.

If compatibility with existing programs is not important, the BOM could be used to identify if a file is UTF-8 versus a legacy encoding, but this is still problematic due to many instances where the BOM is added or removed without actually changing the encoding, or various encodings are concatenated together. Checking if the text is valid UTF-8 is more reliable than using BOM.

Advantages and disadvantages

General

Advantages

• The ASCII characters are represented by themselves as single bytes that do not appear anywhere else, which makes UTF-8 work with the majority of existing APIs that take bytes strings but only treat a small number of ASCII codes specially. This removes the need to write a new Unicode version of every API, and makes it much easier to convert existing systems to UTF-8 than any other Unicode encoding.
• UTF-8 is the only encoding for XML entities that does not require a BOM or an indication of the encoding.^[18]
• UTF-8 and UTF-16 are the standard encodings for Unicode text in HTML documents, with UTF-8 as the preferred and most used encoding.
• UTF-8 strings can be fairly reliably recognized as such by a simple heuristic algorithm.^[19] The chance of a random string of bytes being valid UTF-8 and not pure ASCII is 3.9% for a two-byte sequence, 0.41% for a three-byte sequence and 0.026% for a four-byte sequence.^[20] ISO/IEC 8859-1 is even less likely to be mis-recognized as UTF-8: the only non-ASCII characters in it would have to be in sequences starting with either an accented letter or the multiplication symbol and ending with a symbol. This is an advantage that most other encodings do not have, causing errors (mojibake) if the receiving application isn't told and can't guess the correct encoding. Even UTF-16 can be mistaken for other encodings (like in the bush hid the facts bug).
• Sorting of UTF-8 strings as arrays of unsigned bytes will produce the same results as sorting them based on Unicode code points.
• Other byte-based encodings can pass through the same API. This means, however, that the encoding must be identified. Because the other encodings are unlikely to be valid UTF-8, a reliable way to implement this is to assume UTF-8 and switch to a legacy encoding only if several invalid UTF-8 byte sequences are encountered.

Disadvantages

• A UTF-8 parser that is not compliant with current versions of the standard might accept a number of different pseudo-UTF-8 representations and convert them to the same Unicode output. This provides a way for information to leak past validation routines designed to process data in its eight-bit representation.^[21]
• The introduction of UTF-8 gave one new active encoding on top of the locally established encoding. To have two actively used encodings gave bugs and confusion, and UTF-8 was blamed for that in countries where there had not been any encoding troubles for some years.

Compared to single-byte encodings

Advantages

• UTF-8 can encode any Unicode character, avoiding the need to figure out and set a "code page" or otherwise indicate what character set is in use, and allowing output in multiple languages at the same time. For many languages there has been more than one single-byte encoding in usage, so even knowing the language was insufficient information to display it correctly.
• The bytes 0xfe and 0xff do not appear, so a valid UTF-8 stream never matches the UTF-16 byte order mark and thus cannot be confused with it. The absence of 0xFF (\377) also eliminates the need to escape this byte in Telnet (and FTP control connection).

Disadvantages

• UTF-8 encoded text is larger than the appropriate single-byte encoding except for plain ASCII characters. In the case of languages which used 8-bit character sets with non-Latin alphabets encoded in the upper half (such as most Cyrillic and Greek alphabet code pages), letters in UTF-8 will be double the size. For some languages such as Hindi's Devanagari and Thai, letters will be triple the size (this has caused objections in India and other countries).
• It is possible in UTF-8 (or any other multi-byte encoding) to split a string in the middle of a character, which may result in an invalid string if the pieces are not concatenated later.
• If the code points are all the same size, measurements of a fixed number of them is easy. Due to ASCII-era documentation where "character" is used as a synonym for "byte" this is often considered important. However, by measuring string positions using bytes instead of "characters" most algorithms can be easily and efficiently adapted for UTF-8.

Compared to other multi-byte encodings

Advantages

• UTF-8 uses the codes 0-127 only for the ASCII characters.
• UTF-8 can encode any Unicode character. Files in different languages can be displayed correctly without having to choose the correct code page or font. For instance Chinese and Arabic can be in the same text without special codes inserted to switch the encoding.
• UTF-8 is "self-synchronizing": character boundaries are easily found when searching either forwards or backwards. If bytes are lost due to error or corruption, one can always locate the beginning of the next character and thus limit the damage. Many multi-byte encodings are much harder to resynchronize.
• Any byte oriented string searching algorithm can be used with UTF-8 data, since the sequence of bytes for a character cannot occur anywhere else. Some older variable-length encodings (such as Shift JIS) did not have this property and thus made string-matching algorithms rather complicated.
• Efficient to encode using simple bit operations. UTF-8 does not require slower mathematical operations such as multiplication or division (unlike the obsolete UTF-1 encoding).

Disadvantages

• UTF-8 often takes more space than an encoding made for one or a few languages. Latin letters with diacritics and characters from other alphabetic scripts typically take one byte per character in the appropriate multi-byte encoding but take two in UTF-8. East Asian scripts generally have two bytes per character in their multi-byte encodings yet take three bytes per character in UTF-8.

Compared to UTF-16

Advantages

• Converting to UTF-16 while maintaining compatibility with existing programs (such as was done with Windows) requires every API and data structure that takes a string to be duplicated. Handling of invalid encodings makes this much more difficult than it may first appear.
• Byte streams containing invalid UTF-8 cannot be losslessly converted to UTF-16. Invalid UTF-16 however can be losslessly converted to UTF-8. This turns out to be surprisingly important in practice.
• Characters outside the basic multilingual plane are not a special case. UTF-16 is often mistaken to be the obsolete constant-length UCS-2 encoding, leading to code that works for most text but suddenly fails for non-BMP characters.
• ASCII characters take 1 byte in UTF-8 and 2 in UTF-16. Text in all languages using codepoints below U+0800 (which includes all modern European languages) will be smaller in UTF-8 due to the presence of ASCII spaces, newlines, numbers, punctuation, and Latin letters.
• Most communication and storage was designed for a stream of bytes. A UTF-16 string must use a pair of bytes for each code, which introduces a couple of potential problems:
  • The order of those two bytes becomes an issue and must be added to the protocol, such as with a byte order mark.
  • If a byte is missing from UTF-16, the whole rest of the string will be meaningless text.

Disadvantages

• A simplistic parser for UTF-16 is unlikely to convert invalid sequences to ASCII. Since the dangerous characters in most situations are ASCII, a simplistic UTF-16 parser is much less dangerous than a simplistic UTF-8 parser.
• Characters U+0800 through U+FFFF use three bytes in UTF-8, but only two in UTF-16. As a result, text in (for example) Chinese, Japanese or Hindi could take more space in UTF-8 if there are more of these characters than there are ASCII characters. This rarely happens in real documents, for example both the Japanese and the Korean UTF-8 article on Wikipedia take more space if saved as UTF-16 than the original UTF-8 version ^[22].
• In UCS-2 (but not UTF-16) Unicode code points are all the same size, making measurements of a fixed number of them easy. Due to ASCII-era documentation where "character" is used as a synonym for "byte" this is often considered important. Most UTF-16 implementations, including Windows, measure UTF-16 non-BMP characters as 2 units, as this is the only practical way to handle the strings. The same applies to UTF-8.

See also

• Alt code
• ASCII
• Byte order mark
• Character encodings in HTML
• Comparison of e-mail clients#Features
• Comparison of Unicode encodings
• GB 18030
• Iconv—a standardized API used to convert between different character encodings
• ISO/IEC 8859
• Unicode and e-mail
• Unicode and HTML
• UTF-8 in URIs
• UTF-9 and UTF-18
• UTF-16/UCS-2
• Universal Character Set

References

External links

There are several current definitions of UTF-8 in various standards documents:

• RFC 3629 / STD 63 (2003), which establishes UTF-8 as a standard Internet protocol element
• The Unicode Standard, Version 5.0, §3.9 D92, §3.10 D95 (2007)
• The Unicode Standard, Version 4.0, §3.9–§3.10 (2003)
• ISO/IEC 10646:2003 Annex D (2003)

They supersede the definitions given in the following obsolete works:

• ISO/IEC 10646-1:1993 Amendment 2 / Annex R (1996)
• The Unicode Standard, Version 2.0, Appendix A (1996)
• RFC 2044 (1996)
• RFC 2279 (1998)
• The Unicode Standard, Version 3.0, §2.3 (2000) plus Corrigendum #1 : UTF-8 Shortest Form (2000)
• Unicode Standard Annex #27: Unicode 3.1 (2001)

They are all the same in their general mechanics, with the main differences being on issues such as allowed range of code point values and safe handling of invalid input.

• Original UTF-8 paper (or pdf) for Plan 9 from Bell Labs
• RFC 5198 defines UTF-8 NFC for Network Interchange
• UTF-8 test pages by Andreas Prilop, Jost Gippert and the World Wide Web Consortium
• How to configure e-mail clients to send UTF-8 text
• Unix/Linux: UTF-8/Unicode FAQ, Linux Unicode HOWTO, UTF-8 and Gentoo
• The Unicode/UTF-8-character table displays UTF-8 in a variety of formats (with Unicode and HTML encoding information)
• Online Tool for URL Encoding/Decoding according to RFC 3986 / RFC 3629(JavaScript, GPL)
• Unicode and Multilingual Web Browsers from Alan Wood's Unicode Resources describes support and additional configuration of Unicode/UTF-8 in modern browsers
• JSP Wiki Browser Compatibility page details specific problems with UTF-8 in older browsers
• Mathematical Symbols in Unicode
• Unicode.se shows how to set your homepages and databases to UTF-8
• Graphical View of UTF-8 in ICU's Converter Explorer