Control Characters: The Hidden Unicode Code Points

The first 32 code points in Unicode (U+0000–U+001F) and code point U+007F are control characters—inherited directly from ASCII and the older telegraph and teletype conventions. They don't represent printable characters but instead signal actions to the receiving terminal or device. Modern computing rarely uses most of them, but a handful are absolutely ubiquitous in every piece of software ever written.

The Essential Control Characters

• U+0009 CHARACTER TABULATION (HT / Tab): Horizontal tab. Indents text to the next tab stop. Stored as \t in most languages.
• U+000A LINE FEED (LF): New line in Unix/Linux/macOS. \n in C-style escape sequences. The standard line ending for HTTP headers, email, and most internet protocols.
• U+000D CARRIAGE RETURN (CR): Moves the cursor to the start of the line. \r. Used in combination with LF (\r\n) as the Windows line ending and the mandatory line ending in SMTP, HTTP, and other internet protocols.
• U+001B ESCAPE: The start of ANSI escape sequences used to control terminal colour and cursor position. \e or \x1B in most languages.
• U+0000 NULL: The null terminator in C strings. Its presence in a Unicode string can cause security bugs when the string is passed to a C library that treats null as the string terminator.

C1 Control Characters (U+0080–U+009F)

Less well-known are the 32 C1 control characters. These were defined in ISO 6429 for extended terminal control but were then repurposed by Windows-1252 for printable characters (smart quotes, the euro sign, etc.). This mismatch is one reason why Windows-1252 text is sometimes misinterpreted—if a parser assumes a C1 control character but the byte actually encodes a Windows-1252 printable character, garbled output results.

Control Characters in Security

Control characters in user input are a common source of security vulnerabilities. Null bytes can truncate strings, carriage returns can inject headers in log files or email messages, and escape sequences can cause terminal injection attacks. Always sanitise or reject control characters in user-facing input—with the exception of newlines and tabs where they're expected. Browse control characters in the Unicode categories browser (category Cc).