SHshirian·Feb 21, 2026Submission
The Big List of Naughty Strings
24 points · Open discussionminimaxir
big-list-of-naughty-strings
Python2015–2026
minimaxir / big-list-of-naughty-strings
big-list-of-naughty-strings
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
58Distinct people
62Mentions
0Explicit recommenders
47.7KGitHub stars
What to know before exploring
What it is
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year62 dated mentions
Observed mentions: 2015-08-10 14:55:02 UTC to 2026-02-21 21:25:54 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 13 | 1 | 12 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 11 | 4 | 7 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 2 | 2 | 0 |
What Hacker News says
62 sourcesBig List of Naughty Strings (2021)
3 points · Open discussionMandatory mention: https://github.com/minimaxir/big-list-of-naughty-strings
In Charset="WTF-8"Try "Human Injection" next:
https://github.com/minimaxir/big-list-of-naughty-strings/blo...
In What's that touchscreen in my room?Related: https://github.com/minimaxir/big-list-of-naughty-strings
The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.
In Horrible edge cases to consider when dealing with music (2022)The Big List of Naughty Strings
22 points · Open discussionSounds like we need to use the Big List Of Naughty Strings to weed out troublesome usernames...
https://github.com/minimaxir/big-list-of-naughty-strings
In Super sorry to the guy with the username reset on GitHubThe Big List of Naughty Strings
4 points · Open discussionFor fuzzing, the Big List of Naughty Strings is a nice starting point: https://github.com/minimaxir/big-list-of-naughty-strings
In What can’t the internet handle in 2022? ApostrophesOohh, that's a nice exercise. A few more ideas that should be easy to implement:
- Content-Type: application/json, and body {"response"꞉ "success"} (hint: that's not an ASCII colon).
- Content-Type: application/json, and body [[[[[...]]]]] nested ten thousand times.
- Redirect to their own public IP, and at a random common port.
- Redirect to their own public IP in dotless hexadecimal notation (ping 172.217.23.110 -> ping 0xacd9176e).
- From[1], redirect to
http://example.com/;'$(gt=$(perl$IFS-E$IFS's//62/;s/62/chr/e;say');eval$IFS''cowsay$IFS''pwned$IFS$gt/dev/tty)';cowsay$IFS''pwned
(or instead of "cowsay" run "cat" to block their script)
- Pick a header, then insert one from [EICAR test string[2], \x00, \n] somewhere in the middle.
- Or just add a "Server:" header with a random line from the Big List of Naughty Strings[3].
- Redirec
Read the rest
t to a normal URL, but with a trailing dot in the domain name[4], like "example.com.". It's valid, but you'd be surprised how many things it breaks.
- Nested content encoding with "Content-Encoding: gzip, gzip, gzip, gzip, ...", with a random depth. The n-1 payload is "WAZAAAA".
- "Content-Type: image/jpeg" and "Content‑Encoding: gzip" with a valid gzip body... But the ‑ in "Content‑Encoding" is U+2011 NON-BREAKING HYPHEN.
- "Content-Type: image/jpeg" and "Content-Language: en-US\u000bContent‑Encoding: gzip" with a valid gzip body, where \u000b is a vertical tab.
- Spin the wheel of HTTP status codes! res.WriteHeader(rand.Intn(1000))
- Infinite loop sending a 100 (Continue) every five seconds (they might have a timeout for the TCP and TLS handshakes, and even a timeout for the next TCP segment... But did they remember to set a timeout for receiving the HTTP body?). Watch out for running out of connections.
[1] https://github.com/jwilk/url.sh
[2] https://en.wikipedia.org/wiki/EICAR_test_file
[3] https://github.com/minimaxir/big-list-of-naughty-strings
[4] https://en.wikipedia.org/wiki/Fully_qualified_domain_name
This is usually the point to link to the Big List of Naughty Strings: https://github.com/minimaxir/big-list-of-naughty-strings
If your system can handle these it can probably handle most global text.
In Breaking our Latin-1 assumptions (2017)The Big List of Naughty Strings
3 points · Open discussionAn enormously useful list, I’ve used it several times, and it can often dig up some real nastiness if you haven’t been super careful.
This entry, by the way, is a fantastic little easter egg in the list: https://github.com/minimaxir/big-list-of-naughty-strings/blo...
In I couldn't debug the code because of my nameFor a list of strings that often cause problems to, e.g., add to a test suite, see https://github.com/minimaxir/big-list-of-naughty-strings
In I couldn't debug the code because of my nameI would have to do research on whether the list of valid code points depends on the Unicode version. For example, can regional indicator code points (https://en.wikipedia.org/wiki/Regional_indicator_symbol) appear in isolation? If not, is that different in Unicode < 6, where those code points weren’t assigned yet?
Similarly, what about tags (https://en.wikipedia.org/wiki/Tags_(Unicode_block) )? Do these require an U+E007F CANCEL TAG?
The 66 noncharacters certainly need consideration. http://www.unicode.org/faq/private_use.html says:
“Because of this complicated history and confusing changes of wording in the standard over the years regarding what are now known as noncharacters, there is still considerable disagreement about their use and whether they should be considered "illegal" or "invalid" in various contexts”
Edit: also, testing all
Read the rest
code points likely is overkill and using code points in isolation likely isn’t enough. Most tests are better of with something like the big list of naughty strings (https://github.com/minimaxir/big-list-of-naughty-strings)
Showing the 15 most recent of 62 sources. Enable JavaScript to search and browse every indexed mention.