UTF-8: Difference between revisions
mNo edit summary |
CyberShadow (talk | contribs) →Invalid byte sequences: Remove POV uncited statements and fix POV in wording |
||
Line 462: | Line 462: | ||
* a sequence that decodes to an invalid code point as described below |
* a sequence that decodes to an invalid code point as described below |
||
Invalid UTF-8 has been used to bypass security validations in high-profile products including Microsoft's [[Internet Information Services|IIS]] web server<ref name="MS00-078">{{cite web |url=https://www.sans.org/resources/malwarefaq/wnt-unicode.php |author-first=Marvin |author-last=Marin |title=Web Server Folder Traversal MS00-078 |date=2000-10-17}}</ref> and Apache's Tomcat servlet container.<ref name="CVE-2008-2938">{{cite web |url=https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2938 |title=National Vulnerability Database – Summary for CVE-2008-2938}}</ref> <nowiki>RFC 3629</nowiki> states "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."<ref name="rfc3629">{{Cite journal |author-first=F. |author-last=Yergeau |title=RFC 3629 – UTF-8, a transformation format of ISO 10646 |publisher=[[Internet Engineering Task Force]] |year=2003 |url=https://tools.ietf.org/html/rfc3629 |access-date=2015-02-03}}</ref> ''The Unicode Standard'' requires decoders to "...treat any ill-formed code unit sequence as an error condition. This guarantees that it will neither interpret nor emit an ill-formed code unit sequence."<!--anyone have a copy of ISO/IEC 10646-1:2000 annex D for comparison?--> |
|||
According to this recommendation, some implementations of decoders throw exceptions on errors.<ref>[https://docs.oracle.com/javase/8/docs/api/java/io/DataInput.html Java's DataInput IO Interface]</ref> This has the disadvantage that, under certain conditions, it could turn what would otherwise be harmless errors (producing a message such as "no such file") into a [[denial of service]]. Early versions of Python 3.0 would exit immediately if the command line or [[environment variable]]s contained invalid UTF-8,<ref name="PEP383">{{cite web |url=https://www.python.org/dev/peps/pep-0383/ |title=Non-decodable Bytes in System Character Interfaces |date=2009-04-22 |access-date=2014-08-13 |website=python.org}}</ref> making it impossible to handle such errors from within the program. |
|||
An alternative practice is to replace errors with a replacement character. Replacement requires defining how many bytes are in the error. Since Unicode 6<ref>{{Cite web | url=https://www.unicode.org/versions/Unicode6.0.0/ | title=Unicode 6.0.0}}</ref> (October |
|||
Modern practice is to replace errors with a replacement character, and to ensure that systems do not interpret these replacement characters in any dangerous way{{Citation needed|reason=cite an example programming language or framework where this is implemented|date=May 2019}}. The errors can be detected later when it is convenient to report an error, or display as blocks when the string is drawn for the user. |
|||
Replacement requires defining how many bytes are in the error. Early decoders would often use the same number of bytes as the lead byte indicated as the length of the error. This had the unfortunate problem that a dropped byte would cause the error to consume some of the next character(s). It also was difficult to parse in a reverse direction. Since Unicode 6<ref>{{Cite web | url=https://www.unicode.org/versions/Unicode6.0.0/ | title=Unicode 6.0.0}}</ref> (October |
|||
2010), the standard (chapter 3) has “recommended” a "best practice" where the error ends as soon as a disallowed byte is encountered, which is far easier to implement in a state machine. In these decoders {{mono|0xE0,0x80,0x80}} is three errors, not one. This means an error is no more than three bytes long and never contains the start of a valid character. The standard also recommends replacing each error with the [[Specials (Unicode block)#Replacement character|replacement character]] "�" (U+FFFD). |
2010), the standard (chapter 3) has “recommended” a "best practice" where the error ends as soon as a disallowed byte is encountered, which is far easier to implement in a state machine. In these decoders {{mono|0xE0,0x80,0x80}} is three errors, not one. This means an error is no more than three bytes long and never contains the start of a valid character. The standard also recommends replacing each error with the [[Specials (Unicode block)#Replacement character|replacement character]] "�" (U+FFFD). |
||
Revision as of 18:49, 18 August 2019
Standard | Unicode Standard |
---|---|
Classification | Unicode Transformation Format, extended ASCII, variable-width encoding |
Extends | US-ASCII |
Transforms / Encodes | ISO 10646 (Unicode) |
Preceded by | UTF-1 |
UTF-8 is a variable width character encoding capable of encoding all 1,112,064[1] valid code points in Unicode using one to four 8-bit bytes.[2] The encoding is defined by the Unicode Standard, and was originally designed by Ken Thompson and Rob Pike.[3][4] The name is derived from Unicode (or Universal Coded Character Set) Transformation Format – 8-bit.[5]
It was designed for backward compatibility with ASCII. Code points with lower numerical values, which tend to occur more frequently, are encoded using fewer bytes. The first 128 characters of Unicode, which correspond one-to-one with ASCII, are encoded using a single byte with the same binary value as ASCII, so that valid ASCII text is valid UTF-8-encoded Unicode as well. Since ASCII bytes do not occur when encoding non-ASCII code points into UTF-8, UTF-8 is safe to use within most programming and document languages that interpret certain ASCII characters in a special way, such as "/" (slash) in filenames, "\" (backslash) in escape sequences, and "%" in printf.
![](http://upload.wikimedia.org/wikipedia/commons/thumb/9/97/Unicode_Web_growth.svg/350px-Unicode_Web_growth.svg.png)
Since 2009, UTF-8 has been the dominant encoding (of any kind, not just of Unicode encodings) for the World Wide Web (and declared mandatory "for all things" by WHATWG[7]) and as of August 2019[update] accounts for 93.9% of all web pages (some of which are simply ASCII, as it is a subset of UTF-8) and 95% of the top 1,000 highest ranked[8] web pages. The next-most popular multi-byte encodings, Shift JIS and GB 2312, have 0.4% and 0.3% respectively.[9][10][6] The Internet Mail Consortium (IMC) recommended that all e-mail programs be able to display and create mail using UTF-8,[11] and the W3C recommends UTF-8 as the default encoding in XML and HTML.[12]
Description
Since the restriction of the Unicode code-space to 21-bit values in 2003, UTF-8 is defined to encode code points in one to four bytes, depending on the number of significant bits in the numerical value of the code point. The following table shows the structure of the encoding. The x characters are replaced by the bits of the code point. If the number of significant bits is no more than seven, the first line applies; if no more than 11 bits, the second line applies, and so on.
Number of bytes |
Bits for code point |
First code point |
Last code point |
Byte 1 | Byte 2 | Byte 3 | Byte 4 |
---|---|---|---|---|---|---|---|
1 | 7 | U+0000 | U+007F | 0xxxxxxx | |||
2 | 11 | U+0080 | U+07FF | 110xxxxx | 10xxxxxx | ||
3 | 16 | U+0800 | U+FFFF | 1110xxxx | 10xxxxxx | 10xxxxxx | |
4 | 21 | U+10000 | U+10FFFF | 11110xxx | 10xxxxxx | 10xxxxxx | 10xxxxxx |
The first 128 characters (US-ASCII) need one byte. The next 1,920 characters need two bytes to encode, which covers the remainder of almost all Latin-script alphabets, and also Greek, Cyrillic, Coptic, Armenian, Hebrew, Arabic, Syriac, Thaana and N'Ko alphabets, as well as Combining Diacritical Marks. Three bytes are needed for characters in the rest of the Basic Multilingual Plane, which contains virtually all characters in common use[13], including most Chinese, Japanese and Korean characters. Four bytes are needed for characters in the other planes of Unicode, which include less common CJK characters, various historic scripts, mathematical symbols, and emoji (pictographic symbols).
Some of the important features of this encoding are as follows:
- Backward compatibility: Backwards compatibility with ASCII and the enormous amount of software designed to process ASCII-encoded text was the main driving force behind the design of UTF-8. In UTF-8, single bytes with values in the range of 0 to 127 map directly to Unicode code points in the ASCII range. Single bytes in this range represent characters, as they do in ASCII. Moreover, 7-bit bytes (bytes where the most significant bit is 0) never appear in a multi-byte sequence, and no valid multi-byte sequence decodes to an ASCII code-point. A sequence of 7-bit bytes is both valid ASCII and valid UTF-8, and under either interpretation represents the same sequence of characters. Therefore, the 7-bit bytes in a UTF-8 stream represent all and only the ASCII characters in the stream. Thus, many text processors, parsers, protocols, file formats, text display programs, etc., which use ASCII characters for formatting and control purposes, will continue to work as intended by treating the UTF-8 byte stream as a sequence of single-byte characters, without decoding the multi-byte sequences. ASCII characters on which the processing turns, such as punctuation, whitespace, and control characters will never be encoded as multi-byte sequences. It is therefore safe for such processors to simply ignore or pass-through the multi-byte sequences, without decoding them. For example, ASCII whitespace may be used to tokenize a UTF-8 stream into words; ASCII line-feeds may be used to split a UTF-8 stream into lines; and ASCII NUL characters can be used to split UTF-8-encoded data into null-terminated strings. Similarly, many format strings used by library functions like "printf" will correctly handle UTF-8-encoded input arguments.
- Fallback and auto-detection: UTF-8 provided backwards compatibility for 7-bit ASCII, but much software and data uses 8-bit extended ASCII encodings designed prior to the adoption of Unicode to represent the character sets of European languages. Part of the popularity of UTF-8 is due to the fact that it provides a form of backward compatibility for these as well. A UTF-8 processor which erroneously receives an extended ASCII file as input can "fall back" or replace 8-bit bytes using the appropriate code-point in the Unicode Latin-1 Supplement block, when the 8-bit byte appears outside a valid multi-byte sequence. The bytes in extended ASCII encodings of “real world” text are typically not legal UTF-8 multi-byte sequences. This is because the bytes which introduce multi-byte sequences in UTF-8 are primarily accented letters (mostly vowels) in the common extended ASCII encodings, and the UTF-8 continuation bytes are punctuation and symbol characters. To appear as a valid UTF-8 multi-byte sequence, a series of 2 to 4 extended ASCII 8-bit characters would have to be an unusual combination of symbols and accented letters (such as an accented vowel followed immediately by certain punctuation). In short, real-world extended ASCII character sequences which look like valid UTF-8 multi-byte sequences are unlikely. Fallback errors will be false negatives, and these will be rare. Moreover, in many applications, such as text display, the consequence of incorrect fallback is usually slight. Only legibility is affected, and only for a few characters. These two things make fallback feasible, if somewhat imperfect. Indeed, as discussed further below, the HTML5 standard requires that erroneous bytes in supposed UTF-8 data be replaced upon display on the assumption that they are Windows-1252 characters. The presence of invalid 8-bit characters outside valid multi-byte sequences can also be used to "auto-detect" that an encoding is actually an extended ASCII encoding rather than UTF-8, and decode it accordingly. A UTF-8 stream may simply contain errors, resulting in the auto-detection scheme producing false positives; but auto-detection is successful in the majority of cases, especially with longer texts, and is widely used.
- Prefix code: The first byte indicates the number of bytes in the sequence. Reading from a stream can instantaneously decode each individual fully received sequence, without first having to wait for either the first byte of a next sequence or an end-of-stream indication. The length of multi-byte sequences is easily determined by humans as it is simply the number of high-order 1s in the leading byte. An incorrect character will not be decoded if a stream ends mid-sequence.
- Self-synchronization: The leading bytes and the continuation bytes do not share values (continuation bytes start with 10 while single bytes start with 0 and longer lead bytes start with 11). This means a search will not accidentally find the sequence for one character starting in the middle of another character. It also means the start of a character can be found from a random position by backing up at most 3 bytes to find the leading byte. An incorrect character will not be decoded if a stream starts mid-sequence, and a shorter sequence will never appear inside a longer one.
- Sorting order: The chosen values of the leading bytes means that a list of UTF-8 strings can be sorted in code point order by sorting the corresponding byte sequences.
Examples
Consider the encoding of the Euro sign, €:
- The Unicode code point for "€" is U+20AC.
- According to the scheme table above, this will take three bytes to encode, since it is between U+0800 and U+FFFF.
- Hexadecimal 20AC is binary 0010 0000 1010 1100. The two leading zeros are added because, as the scheme table shows, a three-byte encoding needs exactly sixteen bits from the code point.
- Because the encoding will be three bytes long, its leading byte starts with three 1s, then a 0 (1110...)
- The four most significant bits of the code point are stored in the remaining low order four bits of this byte (1110 0010), leaving 12 bits of the code point yet to be encoded (...0000 1010 1100).
- All continuation bytes contain exactly six bits from the code point. So the next six bits of the code point are stored in the low order six bits of the next byte, and 10 is stored in the high order two bits to mark it as a continuation byte (so 1000 0010).
- Finally the last six bits of the code point are stored in the low order six bits of the final byte, and again 10 is stored in the high order two bits (1010 1100).
The three bytes 1110 0010 1000 0010 1010 1100 can be more concisely written in hexadecimal, as E2 82 AC.
The following table summarises this conversion, as well as others with different lengths in UTF-8. The colors indicate how bits from the code point are distributed among the UTF-8 bytes. Additional bits added by the UTF-8 encoding process are shown in black.
Character | Code point | UTF-8 | ||||
---|---|---|---|---|---|---|
Octal | Binary | Binary | Octal | Hexadecimal | ||
$ | U+0024 | 044 | 010 0100 | 00100100 | 044 | 24 |
¢ | U+00A2 | 0242 | 000 1010 0010 | 11000010 10100010 | 302 242 | C2 A2 |
ह | U+0939 | 004471 | 0000 1001 0011 1001 | 11100000 10100100 10111001 | 340 244 271 | E0 A4 B9 |
€ | U+20AC | 020254 | 0010 0000 1010 1100 | 11100010 10000010 10101100 | 342 202 254 | E2 82 AC |
𐍈 | U+10348 | 0201510 | 0 0001 0000 0011 0100 1000 | 11110000 10010000 10001101 10001000 | 360 220 215 210 | F0 90 8D 88 |
Since UTF-8 uses groups of six bits, it is sometimes useful to use octal notation which uses 3-bit groups. With a calculator which can convert between hexadecimal and octal it can be easier to manually create or interpret UTF-8 compared with using binary.
- Octal 0–177 (hex 0–7F) is coded with an unchanged single byte.
- Octal 0200–3777 (hex 80–7FF) shall be coded with two bytes. xxyy will be 3xx 2yy.
- Octal 4000–177777 (hex 800–FFFF) shall be coded with three bytes. xxyyzz will be (340 + xx) 2yy 2zz.
- Octal 200000–4177777 (hex 10000–10FFFF) shall be coded with four bytes. wxxyyzz will be 36w 2xx 2yy 2zz.
When converting UTF-8 into code points, the following rules apply:
- Octal 302–337 is the first of two bytes. 3xx 2yy will be xxyy in octal.
- Octal 340–357 is the first of three bytes. 3xx 2yy 2zz will be (xx − 40)yyzz.
- Octal 360–364 is the first of four bytes. 36w 2xx 2yy 2zz will be wxxyyzz.
- Octal 200–277 are continuation bytes, and others beginning with 3 are invalid.
Codepage layout
The following table summarizes usage of UTF-8 code units (individual bytes or octets) in a code page format. The upper half (0_ to 7_) is for bytes used only in single-byte codes, so it looks like a normal code page; the lower half is for continuation bytes (8_ to B_) and leading bytes (C_ to F_), and is explained further in the legend below.
Orange cells with a large dot are continuation bytes. The hexadecimal number shown after a "+" plus sign is the value of the six bits they add.
White cells are the leading bytes for a sequence of multiple bytes, the length shown at the left edge of the row. The text shows the Unicode blocks encoded by sequences starting with this byte, and the hexadecimal code point shown in the cell is the lowest character value encoded using that leading byte.
Red cells must never appear in a valid UTF-8 sequence. The first two red cells (C0 and C1) could be used only for a two-byte encoding of a 7-bit ASCII character which should be encoded in one byte; as described below such "overlong" sequences are disallowed. The red cells in the F row (F5 to FD) indicate leading bytes of 4-byte or longer sequences that cannot be valid because they would encode code points larger than the U+10FFFF limit of Unicode (a limit derived from the maximum code point encodable in UTF-16), and FE and FF were never defined for any purpose in UTF-8.
Pink cells are the leading bytes for a sequence of multiple bytes, of which some, but not all, possible continuation sequences are valid. E0 and F0 could start overlong encodings, in this case the lowest non-overlong-encoded code point is shown. F4 can start code points greater than U+10FFFF which are invalid. ED can start the encoding of a code point in the range U+D800–U+DFFF; these are invalid since they are reserved for UTF-16 surrogate halves.
Overlong encodings
In principle, it would be possible to inflate the number of bytes in an encoding by padding the code point with leading 0s. To encode the Euro sign € from the above example in four bytes instead of three, it could be padded with leading 0s until it was 21 bits long – 000 000010 000010 101100, and encoded as 11110000 10000010 10000010 10101100 (or F0 82 82 AC in hexadecimal). This is called an overlong encoding.
The standard specifies that the correct encoding of a code point use only the minimum number of bytes required to hold the significant bits of the code point. Longer encodings are called overlong and are not valid UTF-8 representations of the code point. This rule maintains a one-to-one correspondence between code points and their valid encodings, so that there is a unique valid encoding for each code point. This ensures that string comparisons and searches are well-defined.
Modified UTF-8 uses the two-byte overlong encoding of U+0000 (the NUL character), 11000000 10000000 (hexadecimal C0 80), instead of 00000000 (hexadecimal 00). This allows the byte 00 to be used as a string terminator.
Invalid byte sequences
Not all sequences of bytes are valid UTF-8. A UTF-8 decoder should be prepared for:
- the red invalid bytes in the above table
- an unexpected continuation byte
- a leading byte not followed by enough continuation bytes (which can happen in simple string truncation)
- an overlong encoding as described above
- a sequence that decodes to an invalid code point as described below
Invalid UTF-8 has been used to bypass security validations in high-profile products including Microsoft's IIS web server[14] and Apache's Tomcat servlet container.[15] RFC 3629 states "Implementations of the decoding algorithm MUST protect against decoding invalid sequences."[16] The Unicode Standard requires decoders to "...treat any ill-formed code unit sequence as an error condition. This guarantees that it will neither interpret nor emit an ill-formed code unit sequence."
According to this recommendation, some implementations of decoders throw exceptions on errors.[17] This has the disadvantage that, under certain conditions, it could turn what would otherwise be harmless errors (producing a message such as "no such file") into a denial of service. Early versions of Python 3.0 would exit immediately if the command line or environment variables contained invalid UTF-8,[18] making it impossible to handle such errors from within the program.
An alternative practice is to replace errors with a replacement character. Replacement requires defining how many bytes are in the error. Since Unicode 6[19] (October 2010), the standard (chapter 3) has “recommended” a "best practice" where the error ends as soon as a disallowed byte is encountered, which is far easier to implement in a state machine. In these decoders 0xE0,0x80,0x80 is three errors, not one. This means an error is no more than three bytes long and never contains the start of a valid character. The standard also recommends replacing each error with the replacement character "�" (U+FFFD).
Another popular practice is to turn each byte into an error. In this case 0xE1,0xA0,0xC0 is three errors, not two. The primary advantage is that there are now only 128 different error bytes. This allows the decoder to define 128 different error replacements such as:
- The invalid Unicode code points U+DC80–U+DCFF where the low eight bits are the byte's value.[20] Sometimes it is called UTF-8B.[21] If the UTF-8 encoding of these points is defined as invalid (so they convert to 3 errors), this would seem to make conversion lossless so the errors can actually be recovered when encoding back to UTF-8. But this runs into a practical difficulty in that the encoder must make sure the sequence of "errors" it is encoding do not actually turn into valid UTF-8. In addition making any surrogate halves invalid means you cannot encode invalid UTF-16.
- The Unicode code points U+0080–U+00FF with the same value as the byte, thus interpreting the bytes according to ISO-8859-1[citation needed] Care must be taken so that the C1 control codes such as NEL 0x0085 do not cause further code to misbehave.
- The Unicode code point for the character represented by the byte in CP1252,[citation needed] which is similar to using ISO-8859-1, except that some characters in the range 0x80–0x9F are mapped into different Unicode code points. For example, 0x80 becomes the Euro sign, U+20AC. This makes text where legacy encodings are mixed with UTF-8 readable, and thus it is commonly done in browsers.
The large number of invalid byte sequences provides the advantage of making it easy to have a program accept both UTF-8 and legacy encodings such as ISO-8859-1. Software can check for UTF-8 correctness, and if that fails assume the input to be in the legacy encoding. It is technically true that this may detect an ISO-8859-1 string as UTF-8, but this is very unlikely if it contains any 8-bit bytes as they all have to be in unusual patterns of two or more in a row, such as "£".
Invalid code points
Since RFC 3629 (November 2003), the high and low surrogate halves used by UTF-16 (U+D800 through U+DFFF) and code points not encodable by UTF-16 (those after U+10FFFF) are not legal Unicode values, and their UTF-8 encoding must be treated as an invalid byte sequence.
Not decoding unpaired surrogate halves makes it impossible to store invalid UTF-16 (such as Windows filenames or UTF-16 that has been split between the surrogates) as UTF-8. To preserve these invalid UTF-16 sequences, their corresponding UTF-8 encodings are sometimes allowed by implementations despite the above rule. There are attempts to define this behavior formally (see WTF-8 and CESU below).
Official name and variants
The official Internet Assigned Numbers Authority (IANA) code for the encoding is "UTF-8".[22] All letters are upper-case, and the name is hyphenated. This spelling is used in all the Unicode Consortium documents relating to the encoding.
Alternatively, the name "utf-8" may be used by all standards conforming to the IANA list (which include CSS, HTML, XML, and HTTP headers),[23] as the declaration is case insensitive.[22]
Other descriptions, such as those that omit the hyphen or replace it with a space, i.e. "utf8" or "UTF 8", are not accepted as correct by the governing standards.[16] Despite this, most agents such as browsers can understand them, and so standards intended to describe existing practice (such as HTML5) may effectively require their recognition.[24]
Unofficially, UTF-8-BOM and UTF-8-NOBOM are sometimes used to refer to text files which respectively contain and lack a byte order mark (BOM).[citation needed] In Japan especially, UTF-8 encoding without BOM is sometimes called "UTF-8N".[25][26]
Supported Windows versions, i.e. Windows 7 and later, have codepage 65001, as a synonym for UTF-8 (with better support than in older Windows),[27] and Microsoft has a script for Windows 10, to enable it by default for its notepad program.[28]
In PCL, UTF-8 is called Symbol-ID "18N" (PCL supports 183 character encodings, called Symbol Sets, which potentially could be reduced to one, 18N, that is UTF-8).[29]
Derivatives
The following implementations show slight differences from the UTF-8 specification. They are incompatible with the UTF-8 specification and may be rejected by conforming UTF-8 applications.
CESU-8
Many programs added UTF-8 conversions for UCS-2 data and did not alter this UTF-8 conversion when UCS-2 was replaced with the surrogate-pair using UTF-16. In such programs each half of a UTF-16 surrogate pair is encoded as its own three-byte UTF-8 encoding, resulting in six-byte sequences rather than four bytes for characters outside the Basic Multilingual Plane. Oracle and MySQL databases use this, as well as Java and Tcl as described below, and probably many Windows programs where the programmers were unaware of the complexities of UTF-16. Although this non-optimal encoding is generally not deliberate, a supposed benefit is that it preserves UTF-16 binary sorting order when CESU-8 is binary sorted.
Modified UTF-8
In Modified UTF-8 (MUTF-8),[30] the null character (U+0000) uses the two-byte overlong encoding 11000000 10000000 (hexadecimal C0 80), instead of 00000000 (hexadecimal 00). Modified UTF-8 strings never contain any actual null bytes but can contain all Unicode code points including U+0000,[31] which allows such strings (with a null byte appended) to be processed by traditional null-terminated string functions.
All known Modified UTF-8 implementations also treat the surrogate pairs as in CESU-8.
In normal usage, the Java programming language supports standard UTF-8 when reading and writing strings through InputStreamReader
and OutputStreamWriter
(if it is the platform's default character set or as requested by the program). However it uses Modified UTF-8 for object serialization[32] among other applications of DataInput
and DataOutput
, for the Java Native Interface,[33] and for embedding constant strings in class files.[34]
The dex format defined by Dalvik also uses the same modified UTF-8 to represent string values.[35]
Tcl also uses the same modified UTF-8[36] as Java for internal representation of Unicode data, but uses strict CESU-8 for external data.
WTF-8
WTF-8 (Wobbly Transformation Format – 8-bit) is an extension of UTF-8 where the encodings of unpaired surrogate halves (U+D800 through U+DFFF) are allowed.[37] This is necessary to store possibly-invalid UTF-16, such as Windows filenames. Many systems that deal with UTF-8 work this way without considering it a different encoding, as it is simpler.
The term "WTF-8" has also been used humorously to refer to erroneously doubly-encoded UTF-8[38][39] sometimes with the implication that CP1252 bytes are the only ones encoded.[40]
Byte order mark
Many Windows programs (including Windows Notepad) add the bytes 0xEF, 0xBB, 0xBF at the start of any document saved as UTF-8. This is the UTF-8 encoding of the Unicode byte order mark (BOM), and is commonly referred to as a UTF-8 BOM, even though it is not relevant to byte order. A BOM can also appear if another encoding with a BOM is translated to UTF-8 without stripping it. Software that is not aware of multi-byte encodings will display the BOM as three garbage characters at the start of the document, e.g. "" in software interpreting the document as ISO 8859-1 or Windows-1252 or "" if interpreted as code page 437, a default for certain console applications.
The Unicode Standard neither requires nor recommends the use of the BOM for UTF-8, but warns that it may be encountered at the start of a file as a transcoding artifact.[41] The presence of the UTF-8 BOM may cause problems with existing software that can handle UTF-8, for example:
- Programming language parsers not explicitly designed for UTF-8 can often handle UTF-8 in string constants and comments, but will choke on encountering a UTF-8 BOM at the start of the file.
- Programs that identify file types by leading characters may fail to identify the file if a UTF-8 BOM is present even if the user of the file could skip the BOM. An example is the Unix shebang syntax. Another example is Internet Explorer which will render pages in standards mode only when it starts with a document type declaration.[citation needed]
- Programs that insert information at the start of a file will break use of the BOM to identify UTF-8 (one example is offline browsers that add the originating URL to the start of the file[citation needed]).
History
By early 1992, the search was on for a good byte-stream encoding of multi-byte character sets. The draft ISO 10646 standard contained a non-required annex called UTF-1 that provided a byte stream encoding of its 32-bit code points. This encoding was not satisfactory on performance grounds, among other problems, and the biggest problem was probably that it did not have a clear separation between ASCII and non-ASCII: new UTF-1 tools would be backward compatible with ASCII-encoded text, but UTF-1-encoded text could confuse existing code expecting ASCII (or extended ASCII), because it could contain continuation bytes in the range 0x21–0x7E that meant something else in ASCII, e.g., 0x2F for '/', the Unix path directory separator, and this example is reflected in the name and introductory text of its replacement. The table below was derived from a textual description in the annex.
Number of bytes |
First code point |
Last code point |
Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 |
---|---|---|---|---|---|---|---|
1 | U+0000 | U+009F | 00–9F | ||||
2 | U+00A0 | U+00FF | A0 | A0–FF | |||
2 | U+0100 | U+4015 | A1–F5 | 21–7E, A0–FF | |||
3 | U+4016 | U+38E2D | F6–FB | 21–7E, A0–FF | 21–7E, A0–FF | ||
5 | U+38E2E | U+7FFFFFFF | FC–FF | 21–7E, A0–FF | 21–7E, A0–FF | 21–7E, A0–FF | 21–7E, A0–FF |
In July 1992, the X/Open committee XoJIG was looking for a better encoding. Dave Prosser of Unix System Laboratories submitted a proposal for one that had faster implementation characteristics and introduced the improvement that 7-bit ASCII characters would only represent themselves; all multi-byte sequences would include only bytes where the high bit was set. The name File System Safe UCS Transformation Format (FSS-UTF) and most of the text of this proposal were later preserved in the final specification.[42][43][44][45]
Number of bytes |
First code point |
Last code point |
Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 |
---|---|---|---|---|---|---|---|
1 | U+0000 | U+007F | 0xxxxxxx | ||||
2 | U+0080 | U+207F | 10xxxxxx | 1xxxxxxx | |||
3 | U+2080 | U+8207F | 110xxxxx | 1xxxxxxx | 1xxxxxxx | ||
4 | U+82080 | U+208207F | 1110xxxx | 1xxxxxxx | 1xxxxxxx | 1xxxxxxx | |
5 | U+2082080 | U+7FFFFFFF | 11110xxx | 1xxxxxxx | 1xxxxxxx | 1xxxxxxx | 1xxxxxxx |
In August 1992, this proposal was circulated by an IBM X/Open representative to interested parties. A modification by Ken Thompson of the Plan 9 operating system group at Bell Labs made it somewhat less bit-efficient than the previous proposal but crucially allowed it to be self-synchronizing, letting a reader start anywhere and immediately detect byte sequence boundaries. It also abandoned the use of biases and instead added the rule that only the shortest possible encoding is allowed; the additional loss in compactness is relatively insignificant, but readers now have to look out for invalid encodings to avoid reliability and especially security issues. Thompson's design was outlined on September 2, 1992, on a placemat in a New Jersey diner with Rob Pike. In the following days, Pike and Thompson implemented it and updated Plan 9 to use it throughout, and then communicated their success back to X/Open, which accepted it as the specification for FSS-UTF.[44]
Number of bytes |
First code point |
Last code point |
Byte 1 | Byte 2 | Byte 3 | Byte 4 | Byte 5 | Byte 6 |
---|---|---|---|---|---|---|---|---|
1 | U+0000 | U+007F | 0xxxxxxx | |||||
2 | U+0080 | U+07FF | 110xxxxx | 10xxxxxx | ||||
3 | U+0800 | U+FFFF | 1110xxxx | 10xxxxxx | 10xxxxxx | |||
4 | U+10000 | U+1FFFFF | 11110xxx | 10xxxxxx | 10xxxxxx | 10xxxxxx | ||
5 | U+200000 | U+3FFFFFF | 111110xx | 10xxxxxx | 10xxxxxx | 10xxxxxx | 10xxxxxx | |
6 | U+4000000 | U+7FFFFFFF | 1111110x | 10xxxxxx | 10xxxxxx | 10xxxxxx | 10xxxxxx | 10xxxxxx |
UTF-8 was first officially presented at the USENIX conference in San Diego, from January 25 to 29, 1993.
In November 2003, UTF-8 was restricted by RFC 3629 to match the constraints of the UTF-16 character encoding: explicitly prohibiting code points corresponding to the high and low surrogate characters removed more than 3% of the three-byte sequences, and ending at U+10FFFF removed more than 48% of the four-byte sequences and all five- and six-byte sequences.
Google reported that in 2008, UTF-8 (labelled "Unicode") became the most common encoding for HTML files.[46] By 2018, most languages have use of UTF-8 up in the low to high 90%, including Greek at 97.1%.[47] A few have even 100.0% use such as Kurdish, Pashto, Javanese, Kalaallisut (Greenlandic) and Iranian languages[48] and Sign Languages.[49] Exceptions include mainly Asian languages with Chinese at 88.0%,[50] Japanese at 86.7% (while Mongolian is at 99.7%[51]) and Breton at 70%.[52]
International Components for Unicode has historically used UTF-16, and still does only for Java; while for C/C++ UTF-8 is now supported as the "Default Charset",[53] including the correct handling of "illegal UTF-8".[54]
Comparison with single-byte encodings
- UTF-8 can encode any Unicode character, avoiding the need to figure out and set a "code page" or otherwise indicate what character set is in use, and allowing output in multiple scripts at the same time. For many scripts there have been more than one single-byte encoding in usage, so even knowing the script was insufficient information to display it correctly.
- The bytes 0xFE and 0xFF do not appear, so a valid UTF-8 stream never matches the UTF-16 byte order mark and thus cannot be confused with it. The absence of 0xFF (0377) also eliminates the need to escape this byte in Telnet (and FTP control connection).
- UTF-8 encoded text is larger than specialized single-byte encodings except for plain ASCII characters. In the case of scripts which used 8-bit character sets with non-Latin characters encoded in the upper half (such as most Cyrillic and Greek alphabet code pages), characters in UTF-8 will be double the size. For some scripts, such as Thai and Devanagari (which is used by various South Asian languages), characters will triple in size. There are even examples where a single byte turns into a composite character in Unicode and is thus six times larger in UTF-8. This has caused objections in India and other countries.
- It is possible in UTF-8 (or any other variable-length encoding) to split or truncate a string in the middle of a character. If the two pieces are not re-appended later before interpretation as characters, this can introduce an invalid sequence at both the end of the previous section and the start of the next, and some decoders will not preserve these bytes and result in data loss. Because UTF-8 is self-synchronizing this will however never introduce a different valid character, and it is also fairly easy to move the truncation point backwards to the start of a character.
- If the code points are all the same size, measurements of a fixed number of them is easy. Due to ASCII-era documentation where "character" is used as a synonym for "byte" this is often considered important. However, by measuring string positions using bytes instead of "characters" most algorithms can be easily and efficiently adapted for UTF-8. Searching for a string within a long string can for example be done byte by byte; the self-synchronization property prevents false positives.
- Some software, such as text editors, will refuse to correctly display or interpret UTF-8 unless the text starts with a byte order mark or it contains only ASCII, and will insert such a mark, potentially causing conflicts with such kinds of software as compilers and other requiring a rigid syntax. This, however, is no problem of UTF-8 itself but one of software implementations.
Comparison with other multi-byte encodings
- UTF-8 can encode any Unicode character. Files in different scripts can be displayed correctly without having to choose the correct code page or font. For instance Chinese and Arabic can be supported (in the same text) without special codes inserted or manual settings to switch the encoding.
- UTF-8 is self-synchronizing: character boundaries are easily identified by scanning for well-defined bit patterns in either direction. If bytes are lost due to error or corruption, one can always locate the next valid character and resume processing. If there is a need to shorten a string to fit a specified field, the previous valid character can easily be found. Many multi-byte encodings such as Shift JIS are much harder to resynchronize. This also means that byte oriented string searching algorithms can be used with UTF-8 (as a character is the same as a "word" made up of that many bytes), optimized versions of byte searches can be much faster due to hardware support and lookup tables that have only 256 entries.
- Efficient to encode using simple bit operations. UTF-8 does not require slower mathematical operations such as multiplication or division (unlike Shift JIS, GB 2312 and other encodings).
- UTF-8 will take more space than a multi-byte encoding designed for a specific script. East Asian legacy encodings generally used two bytes per character yet take three bytes per character in UTF-8. Self-synchronization also takes more space.
Comparison with UTF-16
See also Comparison of Unicode encodings
- Byte encodings and UTF-8 are represented by byte arrays in programs, and often nothing needs to be done to a function when converting from a byte encoding to UTF-8. UTF-16 is represented by 16-bit word arrays, and converting to UTF-16 while maintaining compatibility with existing ASCII-based programs (such as was done with Windows) requires every API and data structure that takes a string to be duplicated, one version accepting byte strings and another version accepting UTF-16.
- Text encoded in UTF-8 will be smaller than the same text encoded in UTF-16 if there are more code points below U+0080 than in the range U+0800..U+FFFF. This is true for all modern European languages.
- Text in (for example) Chinese, Japanese or Devanagari will take more space in UTF-8 if there are more of these characters than there are ASCII characters. This is likely when data mainly consist of pure prose, but is lessened by the degree to which the context uses ASCII whitespace, digits, and punctuation.[nb 1]
- Most of the rich text formats (including HTML) contain a large proportion of ASCII characters for the sake of formatting, thus the size usually will be reduced significantly compared with UTF-16, even when the language mostly uses 3-byte long characters in UTF-8.[nb 2]
- Most communication (e.g. HTML and IP) and storage (e.g. for Unix) was designed for a stream of bytes. A UTF-16 string must use a pair of bytes for each code unit:
- The order of those two bytes becomes an issue and must be specified in the UTF-16 protocol, such as with a byte order mark.
- If an odd number of bytes is missing from UTF-16, the whole rest of the string will be meaningless text. Any bytes missing from UTF-8 will still allow the text to be recovered accurately starting with the next character after the missing bytes.
See also
- Alt code
- Character encodings in HTML
- Comparison of e-mail clients § Features
- Comparison of Unicode encodings
- GB 18030
- Iconv – a standardized API used to convert between different character encodings
- ISO/IEC 8859
- Specials (Unicode block)
- Unicode and email
- Unicode and HTML
- Universal Character Set
- UTF-8 in URIs
- UTF-EBCDIC
- UTF-9 and UTF-18
- UTF-16/UCS-2
Notes
- ^ The 2010-11-22 version of यूनिकोड (Unicode in Hindi), when the pure text was pasted to Notepad, generated 19 KB when saved as UTF-16 and 22 KB when saved as UTF-8.
- ^ The 2010-10-27 version of UTF-8 (in Japanese) generated 169 KB when converted with Notepad to UTF-16, and only 101 KB when converted back to UTF-8. The 2010-11-22 version of यूनिकोड (Unicode in Hindi) required 119 KB in UTF-16 and 76 KB in UTF-8.
References
- ^ 17×216 = 1,114,112 code points minus 2,048 technically-invalid surrogate code points
- ^ A group of eight bits is known as an octet in the Unicode Standard.
- ^ a b Email Subject: UTF-8 history, From: "Rob 'Commander' Pike", Date: Wed, 30 Apr 2003..., ...UTF-8 was designed, in front of my eyes, on a placemat in a New Jersey diner one night in September or so 1992...So that night Ken wrote packing and unpacking code and I started tearing into the C and graphics libraries. The next day all the code was done...
- ^ Pike, Rob; Thompson, Ken (1993). "Hello World or Καλημέρα κόσμε or こんにちは 世界" (PDF). Proceedings of the Winter 1993 USENIX Conference.
- ^ "Chapter 2. General Structure". The Unicode Standard (6.0 ed.). Mountain View, California, US: The Unicode Consortium. ISBN 978-1-936213-01-6.
- ^ a b Davis, Mark (2012-02-03). "Unicode over 60 percent of the web". Official Google Blog. Retrieved 2018-08-09.
- ^ "Encoding Standard". encoding.spec.whatwg.org. Retrieved 2018-11-15.
The problems outlined here go away when exclusively using UTF-8, which is one of the many reasons that is now the mandatory encoding for all things.
- ^ "Usage Survey of Character Encodings broken down by Ranking". w3techs.com. Retrieved 2019-07-30.
- ^ "Historical trends in the usage of character encodings". Retrieved 2019-08-17.
- ^ "UTF-8 Usage Statistics". BuiltWith. Retrieved 2011-03-28.
- ^ "Using International Characters in Internet Mail". Internet Mail Consortium. 1998-08-01. Archived from the original on 2007-10-26. Retrieved 2007-11-08.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ "Specifying the document's character encoding", HTML5.2, World Wide Web Consortium, 14 December 2017, retrieved 2018-06-03
- ^ Allen, Julie D.; Anderson, Deborah; Becker, Joe; Cook, Richard, eds. (2012). "The Unicode Standard, Version 6.1". Mountain View, California: Unicode Consortium.
The Basic Multilingual Plane (BMP, or Plane 0) contains the common-use characters for all the modern scripts of the world as well as many historical and rare characters. By far the majority of all Unicode characters for almost all textual data can be found in the BMP.
{{cite journal}}
: Cite journal requires|journal=
(help) - ^ Marin, Marvin (2000-10-17). "Web Server Folder Traversal MS00-078".
- ^ "National Vulnerability Database – Summary for CVE-2008-2938".
- ^ a b Yergeau, F. (2003). "RFC 3629 – UTF-8, a transformation format of ISO 10646". Internet Engineering Task Force. Retrieved 2015-02-03.
{{cite journal}}
: Cite journal requires|journal=
(help) - ^ Java's DataInput IO Interface
- ^ "Non-decodable Bytes in System Character Interfaces". python.org. 2009-04-22. Retrieved 2014-08-13.
- ^ "Unicode 6.0.0".
- ^ Kuhn, Markus (2000-07-23). "Substituting malformed UTF-8 sequences in a decoder". Archived from the original on 2015-03-15. Retrieved 2014-09-25.
- ^ Sittler, B. (2006-04-02). "Binary vs. UTF-8, and why it need not matter". Archived from the original on 2014-07-23. Retrieved 2014-09-25.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ a b "Character Sets". Internet Assigned Numbers Authority. 2013-01-23. Retrieved 2013-02-08.
- ^ Dürst, Martin. "Setting the HTTP charset parameter". W3C. Retrieved 2013-02-08.
- ^ "Encoding Standard § 4.2. Names and labels". WHATWG. Retrieved 2018-04-29.
- ^ "BOM – suikawiki" (in Japanese). Retrieved 2013-04-26.
- ^ Davis, Mark. "Forms of Unicode". IBM. Archived from the original on 2005-05-06. Retrieved 2013-09-18.
- ^ Liviu (2014-02-07). "UTF-8 codepage 65001 in Windows 7 - part I - DosTips.com". www.dostips.com. Retrieved 2018-01-30.
it looks like Win7 silently enhanced support for codepage 65001. Significant limitations do remain - in particular redirection and piping still fail under codepage 65001. Nevertheless, the added support opens up some new exciting possibilities.
- ^ "Script How to set default encoding to UTF-8 for notepad by PowerShell". gallery.technet.microsoft.com. Retrieved 2018-01-30.
- ^ "HP PCL Symbol Sets | Printer Control Language (PCL & PXL) Support Blog". 2015-02-19. Archived from the original on 2015-02-19. Retrieved 2018-01-30.
{{cite web}}
: Unknown parameter|dead-url=
ignored (|url-status=
suggested) (help) - ^ "Java SE documentation for Interface java.io.DataInput, subsection on Modified UTF-8". Oracle Corporation. 2015. Retrieved 2015-10-16.
- ^ "The Java Virtual Machine Specification, section 4.4.7: "The CONSTANT_Utf8_info Structure"". Oracle Corporation. 2015. Retrieved 2015-10-16.
Java virtual machine UTF-8 strings never have embedded nulls.
- ^ "Java Object Serialization Specification, chapter 6: Object Serialization Stream Protocol, section 2: Stream Elements". Oracle Corporation. 2010. Retrieved 2015-10-16.
[…] encoded in modified UTF-8.
- ^ "Java Native Interface Specification, chapter 3: JNI Types and Data Structures, section: Modified UTF-8 Strings". Oracle Corporation. 2015. Retrieved 2015-10-16.
The JNI uses modified UTF-8 strings to represent various string types.
- ^ "The Java Virtual Machine Specification, section 4.4.7: "The CONSTANT_Utf8_info Structure"". Oracle Corporation. 2015. Retrieved 2015-10-16.
[…] differences between this format and the 'standard' UTF-8 format.
- ^ "ART and Dalvik". Android Open Source Project. Archived from the original on 2013-04-26. Retrieved 2013-04-09.
[T]he dex format encodes its string data in a de facto standard modified UTF-8 form, hereafter referred to as MUTF-8.
{{cite web}}
: Unknown parameter|deadurl=
ignored (|url-status=
suggested) (help) - ^ "Tcler's Wiki: UTF-8 bit by bit (Revision 6)". 2009-04-25. Retrieved 2009-05-22.
In orthodox UTF-8, a NUL byte (\x00) is represented by a NUL byte. […] But […] we […] want NUL bytes inside […] strings […]
- ^ Sapin, Simon (2016-03-11) [2014-09-25]. "The WTF-8 encoding". Archived from the original on 2016-05-24. Retrieved 2016-05-24.
{{cite web}}
: Unknown parameter|dead-url=
ignored (|url-status=
suggested) (help) - ^ "WTF-8.com". 2006-05-18. Retrieved 2016-06-21.
- ^ Speer, Robyn (2015-05-21). "ftfy (fixes text for you) 4.0: changing less and fixing more". Archived from the original on 2016-05-21. Retrieved 2016-06-21.
{{cite web}}
:|archive-date=
/|archive-url=
timestamp mismatch; 2015-05-30 suggested (help) - ^ "WTF-8, a transformation format of code page 1252". www-uxsup.csx.cam.ac.uk. Retrieved 2016-10-12.
- ^ "The Unicode Standard – Chapter 2" (PDF). p. 30.
- ^ "Appendix F. FSS-UTF / File System Safe UCS Transformation format" (PDF). The Unicode Standard 1.1. Archived from the original (PDF) on 2016-06-07. Retrieved 2016-06-07.
{{cite journal}}
: Unknown parameter|dead-url=
ignored (|url-status=
suggested) (help) - ^ Whistler, Kenneth (2001-06-12). "FSS-UTF, UTF-2, UTF-8, and UTF-16". Archived from the original on 2016-06-07. Retrieved 2006-06-07.
{{cite web}}
: Unknown parameter|dead-url=
ignored (|url-status=
suggested) (help) - ^ a b Pike, Rob (2003-04-30). "UTF-8 history". Retrieved 2012-09-07.
- ^ Pike, Rob (2012-09-06). "UTF-8 turned 20 years old yesterday". Retrieved 2012-09-07.
- ^ Davis, Mark (2008-05-05). "Moving to Unicode 5.1". Retrieved 2013-03-01.
- ^ "Distribution of Character Encodings among websites that use Greek". w3techs.com. Retrieved 2018-12-03.
- ^ "Distribution of Character Encodings among websites that use Iranian languages". w3techs.com. Retrieved 2018-12-03.
- ^ "Distribution of Character Encodings among websites that use Sign Languages". w3techs.com. Retrieved 2018-12-03.
- ^ "Distribution of Character Encodings among websites that use Chinese". w3techs.com. Retrieved 2018-12-03.
- ^ "Distribution of Character Encodings among websites that use Mongolian". w3techs.com. Retrieved 2018-12-03.
- ^ "Distribution of Character Encodings among websites that use Breton". w3techs.com. Retrieved 2018-12-03.
- ^ "UTF-8 - ICU User Guide". userguide.icu-project.org. Retrieved 2018-04-03.
- ^ "#13311 (change illegal-UTF-8 handling to Unicode "best practice")". bugs.icu-project.org. Retrieved 2018-04-03.
External links
![](http://upload.wikimedia.org/wikipedia/commons/thumb/9/99/Wiktionary-logo-en-v2.svg/40px-Wiktionary-logo-en-v2.svg.png)
There are several current definitions of UTF-8 in various standards documents:
- RFC 3629 / STD 63 (2003), which establishes UTF-8 as a standard Internet protocol element
- The Unicode Standard, Version 11.0, §3.9 D92, §3.10 D95 (2018 June 5)
- ISO/IEC 10646:2014 §9.1
They supersede the definitions given in the following obsolete works:
- ISO/IEC 10646-1:1993 Amendment 2 / Annex R (1996)
- The Unicode Standard, Version 6.0, §3.9 D92, §3.10 D95 (2010)
- The Unicode Standard, Version 5.0, §3.9–§3.10 (2006)
- The Unicode Standard, Version 2.0, Appendix A (1996)
- RFC 2044 (1996)
- RFC 2279 (1998)
- The Unicode Standard, Version 3.0, §2.3 (2000) plus Corrigendum #1 : UTF-8 Shortest Form (2000)
- Unicode Standard Annex #27: Unicode 3.1 (2001)
They are all the same in their general mechanics, with the main differences being on issues such as allowed range of code point values and safe handling of invalid input.
- Original UTF-8 paper (or pdf) for Plan 9 from Bell Labs
- RFC 5198 defines UTF-8 NFC for Network Interchange
- UTF-8 test pages by Andreas Prilop, Jost Gippert and the World Wide Web Consortium
- Unix/Linux: UTF-8/Unicode FAQ, Linux Unicode HOWTO, UTF-8 and Gentoo
- Characters, Symbols and the Unicode Miracle – Computerphile on YouTube