Unicode Blocks Reference

Planes and code points

Unicode defines a code space from U+0000 to U+10FFFF — 1,114,112 possible code points, divided into 17 planes of 65,536 each. As of Unicode 15.1 about 149,800 are assigned, so roughly 87% of the space remains free.

The BMP/astral distinction matters in code. UTF-16 — used internally by JavaScript, Java and Windows — represents BMP characters in one 16-bit unit and everything above in a surrogate pair. That is why '😀'.length is 2 in JavaScript and why naive string slicing can cut an emoji in half.

Common blocks

A block is a contiguous range reserved for a related set of characters. There are over 300; these are the ones you are most likely to meet.

How UTF-8 encodes each range

UTF-8 is a variable-width encoding. The number of bytes follows directly from the code point value:

The design is self-synchronising: a leading byte always starts with a distinctive prefix and continuation bytes always start with 10. Land anywhere in a UTF-8 stream and you can find the next character boundary by scanning forward for a byte that does not start with 10. That property is why UTF-8 survives truncation and packet loss so much better than UTF-16.

Practical consequence: English text costs 1 byte per character, European accented text 2, CJK 3, emoji 4. A CJK page is roughly three times the bytes of the same content in English.

Surrogates, combining marks and normalisation

Surrogates (U+D800–U+DFFF) are not characters. They exist solely as the UTF-16 mechanism for encoding astral code points and are permanently unassigned in Unicode. A lone surrogate in a string is invalid and will not encode to UTF-8.

Combining marks mean one visible glyph can be several code points. é can be U+00E9 (a single precomposed character) or U+0065 U+0301 (e followed by a combining acute accent). They look identical and compare unequal.

Normalisation resolves this. Four forms exist; two matter:

• NFC composes where possible. This is what you want for storage, comparison and URLs, and what the W3C recommends for the web.
• NFD decomposes. Useful for stripping accents: decompose, then remove the combining marks.

'caf\u00e9' === 'cafe\u0301'                      // false
'caf\u00e9'.normalize('NFC') === 'cafe\u0301'.normalize('NFC')  // true

// strip accents
s.normalize('NFD').replace(/\p{Diacritic}/gu, '')

Always normalise to NFC before comparing user input, storing usernames or generating slugs. The slug generator does this as part of its transliteration step.

Confusables and homograph attacks

Unicode contains many characters that look identical to Latin letters. Cyrillic а (U+0430) is visually indistinguishable from Latin a (U+0061) in most fonts. Register аpple.com and it displays as apple.com.

Defences that actually work:

• Browsers show Punycode (xn--pple-43d.com) when a domain mixes scripts, which is the main mitigation.
• Restrict usernames and identifiers to a single script, or to a defined allowed set.
• Apply the Unicode confusable-skeleton algorithm from UTS #39 when uniqueness matters.
• Reject zero-width characters (U+200B–U+200D) and bidirectional overrides (U+202A–U+202E) in identifiers. The 2021 “Trojan Source” research showed bidi overrides can make source code read differently to a human than to a compiler.

Frequently Asked Questions