Big List of Naughty Strings
A text file of tricky strings that often break software, used to test how apps handle bad input.
- Stars
- 47.7k
- Forks
- 2.1k
- Licence
- MIT
- Language
- Python
- Last update
- 2.6 years ago
- Type
- Other
No commits in over a year — check for forks or alternatives before adopting.
What it is
The Big List of Naughty Strings is a collection of text strings known to cause problems when software accepts them as user input, such as unusual Unicode characters, special symbols, and long or malformed values. Testers paste or load these strings into forms and fields to see whether an application crashes, displays errors, or mishandles the input. The list is provided as a plain text file with sections, plus a JSON version for programmatic use.
- Paste strings from the text file into a web form to see if the page breaks
- Load blns.json in a unit test to run the same bad inputs against an API
- Check how a database or search field handles zero-width and right-to-left characters
- Use section comments in blns.txt to find and copy strings by category
Great for
- QA engineers adding input edge cases to manual test passes
- Developers writing automated tests for form validation and string handling
- Teams checking that their own services handle unusual Unicode without server errors
- Anyone who wants a ready-made starting set of problematic inputs instead of writing their own
Not ideal for
- People testing software they do not own or manage, because the README warns some strings may be illegal to use against third-party systems
- Teams expecting a full security audit, since the README says it is not a substitute for formal security or penetration testing
- Non-technical users looking for an application; this is a data file, not a program
How to get it
- 1
See the README
Clone the repository
git clone https://github.com/minimaxir/big-list-of-naughty-strings - 2
Run it
- Clone the repository or open blns.txt on GitHub
- Open blns.txt in a text editor and find a section that matches the input you want to test
- Copy strings into the input field you are testing and note any errors or unexpected behavior
- For automated tests, load blns.json, which contains the strings without comments
- 3
Get the most out of it
- Use the section comments in blns.txt to test one category of input at a time
- Load blns.json directly in automated test suites to repeat the same checks on every build
- Try one of the listed package ports (npm, .NET, PHP, C++) if your stack matches
- Combine the list with formal security testing, since the README does not present it as a replacement
Downloads
Strengths
- Simple, readable format: newline-delimited text with comments for sections
- Provides a JSON version for programmatic use
- Widely referenced and has community ports to several package managers
Trade-offs
- It is a static list, so it will not find problems outside the strings it contains
- Some strings can be flagged by antivirus tools, and the README notes this for one example
- Ports to other package ecosystems are maintained by outside parties and may vary
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.