Generate Invalid UTF8
Create UTF8 that has invalid byte sequences in it. Runs entirely in your browser, so your data never leaves your device.
Output
The result appears here as you type.
How to use Generate Invalid UTF8
- 1. Set how many bad sequences to generate. Enter a number for How many bad sequences. Each one is a byte pattern that violates the UTF-8 spec, such as a stray continuation byte or an overlong encoding.
- 2. Pick an output format. Choose Hex for the classic two-digit-per-byte view used in most debugging tools, or Decimal if you need the raw integer values to plug into code directly.
- 3. Set a separator. Type the character or string that should sit between byte values, such as a space or comma, so the output matches the format your test harness or documentation expects.
- 4. Copy the byte sequence. Use the generated bytes as a negative test case in a decoder, parser or protocol implementation that needs to reject malformed input correctly.
When to use Generate Invalid UTF8
Generate Invalid UTF8 produces byte sequences that break the UTF-8 encoding rules on purpose, things like lone continuation bytes and overlong encodings. Every text-handling library needs to be tested against inputs like this to make sure it fails safely instead of crashing or silently accepting garbage.
- Writing a decoder's negative test suite. You are implementing a UTF-8 decoder and need known-bad byte sequences to confirm it rejects them with the right error rather than throwing an unhandled exception or producing garbage output.
- Fuzzing a network protocol parser. A protocol parser reads UTF-8 strings off the wire and you want to check it survives malformed input from a misbehaving or malicious client without crashing the service.
- Demonstrating an overlong encoding exploit. You are writing security documentation about why overlong UTF-8 sequences were historically used to smuggle characters past input filters, and need real example bytes to illustrate the point.
Examples
Five invalid byte sequences
Output
80 c0 80 e2 82 ff ...
About the Generate Invalid UTF8 tool
Generate Invalid UTF8 is a free online tool that works entirely inside your web browser. Create UTF8 that has invalid byte sequences in it. Because the processing happens on your own device, nothing you enter is uploaded, logged or stored anywhere.
This page is one of 69 UTF-8 utilities on EditSafely. Each one does a single job well, and all of them follow the same rule: your input stays on your machine.
You can shape the output with 3 settings, including How many bad sequences, Output format and Separator, and the result refreshes the moment you change one. A worked example further down the page shows exactly what the tool produces for a real input.
Because nothing leaves your device, the tool is suitable for sensitive content such as internal documents, credentials or customer data. It also responds instantly, since every keystroke is handled on your own machine rather than by a remote API.
Frequently asked questions
Does Generate Invalid UTF8 cost anything?
Yes, it is completely free. All 2,658 tools on EditSafely work without an account, a subscription or usage limits.
Does the generator send anything to a server?
No data leaves your device. The whole tool is JavaScript that runs inside your browser tab, so there is no upload, no server-side processing and no log of what you did. If you disconnect from the internet after the page loads, it keeps working.
How do I get a different result?
Run the generator again. Each run is computed fresh on your device, and any options you change are applied to the next result immediately.
Do I need to sign up or install anything?
Nothing to install and no account needed. Open the page in any up-to-date browser, including on a phone or tablet, and the tool is ready.
How do I use the result?
The output panel has a one-click copy button, and you can keep refining the input while you work; the result updates in place as you type.