Everything's currently running on UTF-8 internally, which is safe with this method. I'll strip out < 0x20 though, maybe replace them with \u001F etc? Non-UTF-8 text would cause all sorts of problems as outlined above, so i think the most convenient solution is to ensure that user input is converted to UTF-8 if necessary, and enforce "all JSON is UTF-8". UTF-16 and UTF-32 are the only other technically valid JSON encodings, so i think requiring UTF-8 only for JSON is okay.