Special Character Dataset Generator

Runs in browser Test Data

A curated catalogue of "naughty strings" for injection, escaping and encoding tests — SQL quotes, HTML tags, JSON escapes, null bytes, RTL overrides, zero-width characters and more, with categories to pick from.

TEST DATA ONLY — all generated names, contacts, identifiers and numbers are synthetic and do not belong to real people or accounts.
Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use Special Character Dataset Generator

  1. List the categories you want, one per line (or "all").
  2. Choose whether to include the very long strings.
  3. Press Generate and copy the value column into your inputs.

Special Character Dataset Generator features

  • Over 170 curated strings in 18 categories: SQL, HTML/XSS, JSON, path, control characters, RTL/bidi, zero-width, homoglyphs, emoji, long, whitespace, numeric, format strings, template injection, shell, LDAP/NoSQL, XML/XXE and Unicode oddities
  • A note for every string explaining what it exercises
  • Display column with invisible characters shown as \uXXXX
  • Optional very long strings up to 65,536 characters
  • Category filter and warnings for unknown category names
  • JSON, CSV, SQL, XML, JSON Lines or table output

Special Character Dataset Generator example

SQL and RTL cases

Input:

Categories: sql, rtl

Output:

category,value,note
sql,' OR '1'='1,Classic tautology
sql,"'; DROP TABLE users; --",Stacked query
rtl,invoice\u202Efdp.exe,RLO file-name spoof (shows as invoiceexe.pdf)

Frequently asked questions about Special Character Dataset Generator

What is a naughty string?

An input that tends to break software: SQL and HTML metacharacters, JSON escapes, path traversal, control characters, bidi overrides, zero-width characters, homoglyphs, emoji sequences, very long strings and more.

How should I use the catalogue?

Copy the value column into form fields, API payloads or file names and check that the application escapes, rejects or stores each one correctly; the note column explains the expected risk.

What does the display column show?

The same string with invisible characters written as \uXXXX so you can see NUL bytes, bidi controls and zero-width characters in the preview.

Can I filter by category?

Yes — list the categories you need (sql, html, json, path, control, rtl, zero-width, homoglyph, emoji, long, whitespace, numeric, format, template, command, ldap, xml, unicode) or write "all".