About this tool
Field length limits and character handling are where many input bugs live. This generator builds exact-length strings, including James Bach’s counterstrings, where each marker sits at the position written just before it (“*3*5*7*10*” is 10 characters long), so a truncated value tells you exactly where it was cut. It also provides curated Unicode samples (accents, CJK, right-to-left text, emoji ZWJ sequences, combining marks and zero-width characters), whitespace look-alikes and classic SQL, XSS and path-traversal probe strings for checking your own application’s input handling. For every string it shows the JavaScript length, code points, visible characters (graphemes, via Intl.Segmenter) and UTF-8 bytes, because a database column, an HTML maxlength attribute and a user each count differently.
How to use it
- For length testing, choose Counterstring or Repeat, then type a length or click a common boundary such as 255, 256 or 65535.
- Copy or download the string and paste it into the field under test; check what was saved, where it was cut and whether an error was shown.
- Use the Unicode, Whitespace and Input probes tabs to copy individual edge-case strings. Each one notes what it is designed to reveal.
- Paste any value into “Measure any string” to see its lengths and an escaped form that makes invisible characters visible.
Test String Generator FAQ
Why does a single emoji count as 2, 7 or 11 characters?
JavaScript string length counts UTF-16 code units. An emoji outside the Basic Multilingual Plane uses two, and a ZWJ sequence such as a family emoji joins several emoji with U+200D, so one visible character can have a length of 11 and take 25 bytes in UTF-8. Decide which unit your limit is meant to count and test it explicitly.
Which length should I test: 255 or 256?
Both, plus the limit itself and one either side. If a field allows 255 characters, test 254, 255 and 256. Counterstrings make the result easy to read, because the end of the saved value shows how many characters survived.
Is it safe to use the SQL and XSS probe strings?
They are standard, non-destructive probes used in QA to check that input is parameterised and output is encoded. Use them only on applications you own or are authorised to test. A correctly built system simply stores and displays them as text.