Encoding and security guides
Unicode escapes: code points, UTF-16 and surrogate pairs
Explain why one emoji can occupy two JavaScript string units and choose an escape syntax supported by the target format.
Separate characters and storage units
A Unicode code point is not necessarily one UTF-16 code unit. JavaScript strings use UTF-16 units, so an emoji can have length two.
User-perceived characters can also contain several code points, such as combining marks or emoji sequences. Do not use string.length as a universal character count.
"😀".length → 2
[..."😀"].length → 1JSON uses four-digit escapes
JSON supports \u followed by four hexadecimal digits. A supplementary code point is represented using a high and low surrogate pair.
JavaScript also supports \u{...} code-point escapes in appropriate contexts. That brace syntax is not valid JSON string escape syntax.
JSON: "\ud83d\ude00"
JavaScript: "\u{1F600}"Count encoding layers
A literal backslash-u sequence differs from a character produced by parsing that sequence. A JSON string containing escaped JSON adds another layer.
Decode only the documented layer. Removing backslashes globally can change paths, regular expressions and quoted string data.
Validate complete text
A lone surrogate is not a complete supplementary character, and consumers may handle it differently. Verify the actual destination parser’s behavior.
Round-trip a basic character, an emoji and a combining sequence. Compare bytes separately when a protocol signs or hashes the original UTF-8 text.