Guide · Open source
How to use big-list-of-naughty-strings for input testing
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Big List of Naughty Strings is a list of text strings that have a high chance of causing problems when software accepts them as user input. This guide shows you how to get the list, use it for manual QA passes, and load it in automated tests. After reading, you will be able to pick the right file for your workflow and run the strings against software you own and manage.
Big List of Naughty Stringsminimaxir/big-list-of-naughty-strings · ★ 47.7k · MIT Install options & downloads Quick start
- 1Clone the repository. Run git clone https://github.com/minimaxir/big-list-of-naughty-strings in a terminal to download the files.
- 2Confirm you own the target. Only test software you own and manage, as the README requires.
- 3Pick a file. Use blns.txt for manual copy-and-paste testing or blns.json for automated tests.
- 4Run the strings against an input. Paste strings from one section into a form field, or loop over the blns.json array in a test.
- 5Record failures. Note crashes, server errors, or mishandled output along with the exact string that triggered them.
- 6Fix and retest. Address the validation issues you find and run the same strings again to confirm the fix.
What the list contains and why it matters
The list is aimed at both automated and manual QA testing. Its README gives an example of a zero-width space (U+200B) that caused an internal server error when posted to Twitter. The project's point is that an unexpected input producing a server error is a poor experience and can point to deeper string-validation issues.
The strings include unusual Unicode characters, special symbols, and long or malformed values.
Get the list by cloning the repository
The only install step listed in the README is cloning the repository. No prerequisites are listed. Run the command below in a terminal to download the files, including blns.txt and blns.json.
git clone https://github.com/minimaxir/big-list-of-naughty-stringsUse blns.txt for manual testing
blns.txt holds newline-delimited strings. Lines starting with # are comments that divide the strings into sections. The sections make the file easy to read and copy into input forms one string at a time.
Open the file, pick a section, copy a string, and paste it into the field you want to test. Watch for crashes, error pages, or inputs that display or save incorrectly.
- Use one section at a time so results are easy to trace back to a string.
- Note which string caused a failure so you can reproduce it.
Use blns.json in automated tests
For programmatic access, use blns.json. It is an array containing all the strings, with the comments removed. The README says the scripts folder contains the Python script used to generate this file.
Load the array in your test suite and feed each value to the validation or string-handling code you want to check. Assert on the behaviour you expect, such as a clean rejection or safe handling, rather than only checking that nothing crashes.
Contribute new strings
The project accepts pull requests that add strings or sections. The README asks contributors to avoid strings of 255 or more characters, to avoid changing the file encoding, and to leave out the EICAR test string and the null character (U+0000). When you add or remove a string, update all the files in the same pull request.
Stay within the licence and disclaimer
The README says the list is intended for software you own and manage. Some strings can indicate security vulnerabilities, and using them against third-party software may be a crime. The list is also not a full substitute for formal security or penetration testing.
What people use it for
- QA engineers adding input edge cases to a manual test pass on a web form.
- Developers writing automated tests for form validation and string handling.
- Teams checking that their own services handle unusual Unicode without server errors.
- Anyone who wants a ready-made starting set of problematic inputs instead of writing their own.
Frequently asked questions
How do I install big-list-of-naughty-strings?
The README lists one install step: clone the repository with git clone https://github.com/minimaxir/big-list-of-naughty-strings. It is a data file, so there is no program to install. No prerequisites are listed.
Is big-list-of-naughty-strings free to use?
The project is licensed under MIT, as stated in the README and listing. You can use it under those terms. Check the licence file in the repository for the full text.
What is the difference between blns.txt and blns.json?
blns.txt is newline-delimited text with # comments that divide the strings into sections for manual reading. blns.json is an array with the comments removed, intended for programmatic use.
Can I use the naughty strings on any website?
No. The README says the list is intended for software you own and manage. Some strings may indicate security vulnerabilities, and using them with third-party software may be a crime.
Does this replace a security audit or penetration test?
No. The README states the list is not a fully comprehensive substitute for formal security or penetration testing for your service.
Is there an alternative or a library version?
The README lists community-maintained packages for Node, .NET, PHP and C++, maintained by outside parties. These include npm packages named blns and big-list-of-naughty-strings, a .NET repository by SimonCropp, a PHP repository by mattsparks, and a C++ repository by eliabieri.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this list if you are a QA engineer or developer who needs a ready set of unusual inputs for testing forms and string handling in software you own. Skip it if you want a full security audit, need a program with a user interface, or plan to test systems you do not control.
Install options & downloads