UTF-7 (7-bit Unicode Transformation Format) is a variable-length character encoding that was proposed for representing Unicode text using a stream of ASCII characters, for example for use in Internet E-mail messages. Contents 1 Motivation 2 Description 3 Examples 4 Algorithm for manually encoding and decoding UTF-7 4.1 Encoding 4.2 Decoding 4.3 Security 4.4 Not yet developed: UTF-6 and UTF-5 5 References 6 See also Motivation MIME, the modern standard of E-mail format, forbids encoding of headers using byte values above the ASCII range. Although MIME allows encoding the message body in various character sets (broader than ASCII), the underlying transmission infrastructure (SMTP, the main E-mail transfer standard) is still not guaranteed to be 8-bit clean. Therefore, a non-trivial content transfer encoding has to be applied in case of doubt. Unfortunately base64 has a disadvantage of making even US-ASCII characters unreadable in non-MIME clients. On the other hand, UTF-8 combined with quoted-printable produces a very size-inefficient format requiring 6–9 bytes for non-ASCII characters from the BMP and 12 bytes for characters outside the BMP. Provided certain rules are followed during encoding, UTF-7 can be sent in e-mail without using an underlying MIME transfer encoding, but still must be explicitly identified as the text character set. In addition, if used within e-mail headers such as "Subject:", UTF-7 must be contained in MIME encoded words identifying the character set. Since encoded words force use of either quoted-printable or base64, UTF-7 was designed to avoid using the = sign as an escape character to avoid double escaping when it is combined with quoted-printable (or its variant, the RFC 2047/1522 ?Q?-encoding of headers).

UTF-7 is generally not used as a native representation within applications as it is very awkward to process. Despite its size advantage over the combination of UTF-8 with either quoted-printable or base64, the Internet Mail Consortium recommends against its use.1 8BITMIME has also been introduced, which reduces the need to encode message bodies in a 7-bit format. A modified form of UTF-7 is currently used in the IMAP e-mail retrieval protocol for mailbox names.2 Description UTF-7 was first proposed as an experimental protocol in RFC 1642, A Mail-Safe Transformation Format of Unicode. This RFC has been made obsolete by RFC 2152, an informational RFC which never became a standard. As RFC 2152 clearly states, the RFC "does not specify an Internet standard of any kind". Despite this RFC 2152 is quoted as the definition of UTF-7 in the IANA's list of charsets. Neither is UTF-7 a Unicode Standard. The Unicode Standard 5.0 only lists UTF-8, UTF-16 and UTF-32. There is also a modified version, specified in RFC 2060, which is sometimes identified as UTF-7. Some characters can be represented directly as single ASCII bytes. The first group is known as "direct characters" and contains 62 alphanumeric characters and 9 symbols: ' ( ) , - . / : ?. The direct characters are considered very safe to include literally. The other main group, known as "optional direct characters", contains all other printable characters in the range U+0020–U+007E except ~ \ + and space. Using the optional direct characters reduces size and enhances human readability but also increases the chance of breakage by things like badly designed mail gateways and may require extra escaping when used in encoded words for header fields.

Space, tab, carriage return and line feed may also be represented directly as single ASCII bytes. However, if the encoded text is to be used in e-mail, care is needed to ensure that these characters are used in ways that do not require further content transfer encoding to be suitable for e-mail. The plus sign (+) may be encoded as +-. Other characters must be encoded in UTF-16 (hence U+10000 and higher would be encoded into surrogates) and then in modified Base64. The start of these blocks of modified Base64 encoded UTF-16 is indicated by a + sign. The end is indicated by any character not in the modified Base64 set. If the character after the modified Base64 is a - (ASCII hyphen-minus) then it is consumed by the decoder and decoding resumes with the next character. Otherwise decoding resumes with the character after the base64. Examples "Hello, World!" is encoded as "Hello, World!" "1 + 1 = 2" is encoded as "1 +- 1 = 2" "£1" is encoded as "+AKM-1". The Unicode code point for the pound sign is U+00A3 (which is 00A316 in UTF-16), which converts into modified Base64 as in the table below. There are two bits left over, which are padded to 0. Hex digit 0 0 A 3   Bit pattern 0 0 0 0 0 0 0 0 1 0 1 0 0 0 1 1 0 0 Index 0 10 12 Base64-Encoded A K M Algorithm for manually encoding and decoding UTF-7 Encoding First an encoder must decide which characters to represent directly in ASCII form, which +es have to be escaped as +-, and which to place in blocks of Unicode characters. A simple encoder may encode all characters it considers safe for direct encoding directly. However the cost of coming out of a Unicode block to represent a single character and then going directly back in is 3 to 3⅔ bytes, this is more than the 2⅔ bytes needed to represent such a character as a part of a Unicode sequence. Each Unicode sequence must be encoded using the following procedure, then surrounded by the appropriate delimiters.

We will use the £† (U+00A3 U+2020) character sequence as an example Express the character’s Unicode numbers (UTF-16) in Binary: 0x00A3 → 0000 0000 1010 0011 0x2020 → 0010 0000 0010 0000 Concatenate the binary sequences 0000 0000 1010 0011 and 0010 0000 0010 0000 → 0000 0000 1010 0011 0010 0000 0010 0000 Regroup the binary into groups of six bits, starting from the left: 0000 0000 1010 0011 0010 0000 0010 0000 → 000000 001010 001100 100000 001000 00 If the last group has less than six bits, add trailing zeros: 000000 001010 001100 100000 001000 00 → 000000 001010 001100 100000 001000 000000 Replace each group of six bits with a respective Base64 code: 000000 001010 001100 100000 001000 000000 → AKMgIA Decoding First an encoded data must be separated into plain ASCII text chunks (including +es followed by a dash) and nonempty Unicode blocks as mentioned in the description section. Once this is done, each Unicode block must be decoded with the following procedure (using the result of the encoding example above as our example) Express each Base64 code as the bit sequence it represents: AKMgIA → 000000 001010 001100 100000 001000 000000 Regroup the binary into groups of sixteen bits, starting from the left: 000000 001010 001100 100000 001000 000000 → 0000000010100011 0010000000100000 0000 If there is an incomplete group at the end, discard it (If the incomplete group contains more than four bits or contains any ones, the code is invalid): 0000000010100011 0010000000100000 Each group of 16 bits is a character's Unicode (UTF-16) number and can be expressed in other forms: 0000 0000 1010 0011 ≡ 0x00A3 ≡ 16310 Security

UTF-7 allows multiple representations of the same source string by shifting in and out of the base 64 mode multiple times. But, as mentioned above, UTF-7 is not intended for text processing inside an application. If a web page does not specify an encoding, Internet Explorer tries to guess it, and can be tricked into interpreting the page as UTF-7. This can be used for a cross-site scripting attack as the < and > marks are encoded as +ADw- and +AD4- in UTF-7, which most validators let through as simple text.3 Not yet developed: UTF-6 and UTF-5 See also: Comparison of Unicode encodings#Historical: UTF-5 and UTF-6 Some proposals have been made for a UTF-6 and UTF-5 for radio telegraphy environments,45 however no formal UTF standard has been formalized as of 2010[update]. These proposals are not related to Punycode. References ^ Internet Mail Consortium, Using International Characters in Internet Mail, 1 August 1998, retrieved 8 January 2009 ^ RFC 3501 section 5.1.3 ^ http://code.google.com/p/doctype/wiki/ArticleUtf7 ^ Seng, James, UTF-5, a transformation format of Unicode and ISO 10646, 28 Jan 2000, retrieved 23 August 2007 ^ Welter, Mark; Brian W. Spolarich, WALID, Inc. (2000-11-16). "UTF-6 - Yet Another ASCII-Compatible Encoding for IDN". Internet Engineering Task Force (IETF) INTERNET-DRAFT. The Internet Society. http://tools.ietf.org/html/draft-ietf-idn-utf6-00. Retrieved 2007-08-28.  See also Comparison of Unicode encodings v · d · eUnicode Unicode Unicode Consortium · ISO/IEC 10646 (Universal Character Set) Code points Plane · Block · Mapping characters · Character property · Character charts Characters Special purpose BOM · Combining grapheme joiner · Left-to-right mark and Right-to-left mark · Zero-width non-breaking space · Zero-width joiner · Zero-width non-joiner · Zero-width space Miscellaneous lists Combining character · Duplicate characters · Graphic characters Processing Algorithms Bi-directional text · Collation (ISO 14651) · Equivalence Transformation BOCU-1 · CESU-8 · UTF-1 · UTF-7 · UTF-8 · UTF-9/UTF-18 · UTF-16/UCS-2 · UTF-32/UCS-4 · UTF-EBCDIC · Punycode · SCSU · Comparison On pairs of code points Equivalence · Combining character · Duplicates · Homoglyph · Precomposed character (List) · Compatibility characters · Z-variant Usage Unicode and e-mail · Unicode and HTML · Character entity references · Unicode input · Internationalized domain name · Numeric character reference · Private Use U+F8FF · Typefaces (fonts) Related standards Common Locale Data Repository (CLDR) · GB 18030 · Han unification · ISO/IEC 8859 (8-bit encodings) · ISO 14651 (Collation) · ISO 15924 (Script codes) Related topics Anomalies · ConScript Unicode Registry · Ideographic Rapporteur Group · International Components for Unicode · MUFI · People related to Unicode  Scripts and symbols in Unicode Common and inherited scripts Combining marks · Diacritics · Punctuation · Space Modern scripts Arabic (diacritics) · Armenian · Balinese · Batak · Bamum · Bengali · Bopomofo · Braille · Buginese · Buhid · Canadian Aboriginal · Cham · Cherokee · CJK Unified Ideographs (Han) · Cyrillic · Deseret · Devanagari · Ethiopic · Georgian · Greek · Gujarati · Gurmukhi · Kanji · Hanja · Hán tự · Hangul · Hanunoo · Hebrew (diacritics) · Hiragana · Javanese · Kannada · Katakana · Kayah Li · Khmer · Lao · Latin · Lepcha · Limbu · Lisu · Malayalam · Mandaic · Meetei Mayek · Mongolian · Manchu · Myanmar · N'Ko · New Tai Lue · Ol Chiki · Oriya · Osmanya · Rejang · Samaritan · Saurashtra · Shavian · Sinhala · Sundanese · Syloti Nagri · Syriac · Tagalog · Tagbanwa · Tai Le · Tai Tham · Tai Viet · Tamil · Telugu · Thaana · Thai · Tibetan · Tifinagh · Vai · Yi Ancient and historic scripts Avestan · Brāhmī · Carian · Coptic · Sumero-Akkadian · Cypriot · Egyptian Hieroglyphs · Glagolitic · Gothic · Imperial Aramaic · Inscriptional Pahlavi · Inscriptional Parthian · Kaithi · Kharoshthi · Linear B · Lycian · Lydian · Ogham · Old Italic · Old Persian · Phags-pa · Phoenician · Old South Arabian · Old Turkic · Runic · Ugaritic Symbols Cultural, political, and religious symbols · Currency · Mathematical operators and symbols · Phonetic symbols (including IPA) v · d · eCharacter encodings Category:Character sets Early telecommunications ASCII · ISO/IEC 646 · ISO/IEC 6937 · T.61 · sixbit code pages · Baudot code · Morse code ISO/IEC 8859 -1 · -2 · -3 · -4 · -5 · -6 · -7 · -8 · -9 · -10 · -11 · -12 · -13 · -14 · -15 · -16 Bibliographic use ANSEL · ISO 5426 / 5426-2 / 5427 / 5428 / 6438 / 6861 / 6862 / 10585 / 10586 / 10754 / 11822 · MARC-8 National standards ArmSCII · CNS 11643 · GOST 10859 · GB 2312 · HKSCS · ISCII · JIS X 0201 · JIS X 0208 · JIS X 0212 · JIS X 0213 · KPS 9566 · KS X 1001 · PASCII · TIS-620 · TSCII · VISCII · YUSCII EUC CN · JP · KR · TW ISO/IEC 2022 CN · JP · KR · CCCII MacOS codepages ("scripts") Arabic · CentralEurRoman · ChineseSimp / EUC-CN · ChineseTrad / Big5 · Croatian · Cyrillic · Devanagari · Dingbats · Farsi · Greek · Gujarati · Gurmukhi · Hebrew · Icelandic · Japanese / ShiftJIS · Korean / EUC-KR · Roman · Romanian · Symbol · Thai / TIS-620 · Turkish · Ukrainian DOS codepages 437 · 720 · 737 · 775 · 850 · 852 · 855 · 857 · 858 · 860 · 861 · 862 · 863 · 864 · 865 · 866 · 869 · Kamenický · Mazovia · MIK · Iran System Windows codepages 874 / TIS-620 · 932 / ShiftJIS · 936 / GBK · 949 / EUC-KR · 950 / Big5 · 1250 · 1251 · 1252 · 1253 · 1254 · 1255 · 1256 · 1257 · 1258 · 1361 · 54936 / GB18030 EBCDIC codepages 37/1140 · 273/1141 · 277/1142 · 278/1143 · 280/1144 · 284/1145 · 285/1146 · 297/1147 · 420/16804 · 424/12712 · 500/1148 · 838/1160 · 871/1149 · 875/9067 · 930/1390 · 933/1364 · 937/1371 · 935/1388 · 939/1399 · 1025/1154 · 1026/1155 · 1047/924 · 1112/1156 · 1122/1157 · 1123/1158 · 1130/1164 · JEF · KEIS Platform specific ATASCII · CDC display code · DEC-MCS · DEC Radix-50 · Fieldata · GSM 03.38 · HP roman8 · PETSCII · TI calculator character sets · ZX Spectrum character set Unicode / ISO/IEC 10646 UTF-8 · UTF-16/UCS-2 · UTF-32/UCS-4 · UTF-7 · UTF-EBCDIC · GB 18030 · SCSU · BOCU-1 Miscellaneous codepages APL · Cork · HZ · IBM code page 1133 · KOI8 · TRON Related topics control character (C0 C1) · CCSID · charset detection · Han unification · ISO 6429/IEC 6429/ANSI X3.64 · mojibake