# Naughty Strings List | Hostile Test Inputs

Search 158 hostile test strings for forms, APIs, imports and file names, each with what it tests, and copy them as JSON, CSV, JavaScript or Python.

Canonical: https://tamperbox.dev/naughty-strings

Docs: https://docs.tamperbox.dev/tools/naughty-strings.md

Updated: 2026-10-26

Reviewed: 2026-10-26

## How it works

The list is built into the page: 158 strings in eleven groups, from empty values and whitespace to invisible Unicode, encoding damage, real names that break validation rules, numbers and keywords written as text, dates, emails and URLs, spreadsheet formulas, injection and paths. Each string says what it tests. Search matches the name, the reason and the value, including code points such as U+200B. Copy one string, or copy and download the filtered list as JSON, JavaScript, Python, CSV or one value per line. JSON, JavaScript and Python exports escape invisible characters. CSV preserves values with CSV quoting, and one-per-line export keeps raw values.

The full method, every rule and worked examples are on [docs.tamperbox.dev](https://docs.tamperbox.dev/tools/naughty-strings/).

## Limits and interpretation

Active payloads (injection, spreadsheet formulas and path traversal) are hidden until you include them. They are built to be acted on if they reach a parser, interpreter or file system, so use them only against systems you own or are allowed to test. None of them is malware and none needs a network. The list is a starting set, not a complete security test: a value that is stored and shown unchanged has passed, and anything else is worth a closer look. The one-per-line format cannot hold values that contain line breaks; use JSON or CSV for those. Nothing is stored.

## Frequently asked questions

### What is a naughty string?

A value that is valid input from a person or another system but that software often mishandles: an apostrophe in a surname, an emoji that is two units long in JavaScript, a zero width space that makes two names look the same, or a cell that a spreadsheet runs as a formula.

### Is it safe to paste these into a staging system?

The default list is data only and should be stored and shown unchanged. Active payloads are off until you include them, because they are designed to trigger behaviour in systems that mishandle them. Use those only where you are allowed to test.

### How is this different from the Big List of Naughty Strings?

The idea is the same. This set is smaller, every string carries a reason, active payloads are separated from plain data, and the list can be filtered and exported with invisible characters escaped.

## References

[OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) · [OWASP: CSV Injection](https://owasp.org/www-community/attacks/CSV_Injection) · [Unicode Technical Standard #39: Unicode Security Mechanisms](https://www.unicode.org/reports/tr39/) · [RFC 5321: Simple Mail Transfer Protocol, section 4.5.3.1](https://www.rfc-editor.org/rfc/rfc5321#section-4.5.3.1) · [Microsoft: Naming files, paths, and namespaces](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file).