Hi, in the context of UTF-8, "encode" is generally taken to mean string (of unicode characters, like in JS) -> [byte], and "decode" means [byte] -> string. Every single other API in existence has these semantics.

Even the implementation gives a clue - nacl.util.decodeUTF8 calls unescape(encodeURIComponent(s)), which is the standard JS way to encode a Unicode string into a "UTF-8 string" where each 16-bit character has only 8 semantic bits and the higher 8 bits are not set.

Please deprecate this API and create a new API with correct names, before this turns into a hilariously bad security hole.