Bytes & Characters
Test a length limit with exact-size strings and boundary values, counted in characters, UTF-16 units or UTF-8 bytes.
Generate a string of an exact length in characters, UTF-16 units or UTF-8 bytes, a max-1, max and max+1 test set, or a counterstring, locally. Jump to: Break it.
A string of exactly 255 characters.
255 characters, 255 UTF-16 units, 255 bytes and 255 visible characters.
Strings are built in your browser. Nothing is uploaded, and downloads are made on this device.
Nothing is sent or stored. No server request is made for any input.
The string
abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789abc
Copy and Download take exactly this string, with no line break added.
Limit test set
Length, by every count
| Characters | 255 | Code points. Python len() and most database CHAR limits |
|---|---|---|
| UTF-16 units | 255 | JavaScript, Java and C# string length, and HTML maxlength |
| UTF-8 bytes | 255 | Bytes on the wire, VARCHAR byte limits, file names, headers |
| Visible characters | 255 | What a person counts |
How it works
You choose a length, what it is counted in, and what to fill it with. The string is built from whole characters, so an emoji is never split in half; where the next character would overshoot, a plain "a" closes the gap, so every length can be hit exactly. Characters are Unicode code points, UTF-16 units are what JavaScript, Java and C# report as length and what HTML maxlength counts, and UTF-8 bytes are what a database byte limit, a file name or an HTTP header holds. The limit set builds the empty value, one character, the limit minus one, the limit, the limit plus one, the limit with spaces around it, only spaces, and double the limit. A counterstring writes each asterisk's own position before it, so a value cut short shows where it was cut.
The full method, every rule and worked examples are on docs.tamperbox.dev.
Limits and interpretation
A string is limited to 1,000,000 units and a limit set to 500,000, so the browser stays responsive. Only the first 20,000 UTF-16 units are shown; Copy and Download always take the whole string, with no line break added. A counterstring is ASCII, so all its counts agree. The fill "letters with combining accents" makes text that looks shorter than its code point count; that is the point of it. Nothing is stored.
Frequently asked questions
Why does my 255-character limit accept fewer emoji?
Because the system counts something other than characters. JavaScript and HTML maxlength count UTF-16 units, where each emoji is two, and byte limits count UTF-8, where each emoji is four. Generate the same length in each unit to find which one your system uses.
What should happen at the limit plus one?
The value should be refused with a message. A system that silently cuts it to the limit loses data, and one that accepts it may fail later when the value reaches a column or a header that is shorter.
What is a counterstring?
A string such as *3*5*7*9*12* where every number is the position of the asterisk after it. Paste a long one into a field, read the last number that survived, and you know exactly how many characters the field kept.
References
Unicode Standard Annex #29: Unicode Text Segmentation · RFC 3629: UTF-8 · RFC 2781: UTF-16 · HTML Standard: the maxlength attribute · MDN: String length.
Are you an AI agent? You are in the right place.
This page and every tool are available as plain text with their methods and limits, and the same checks run over MCP.