Sample TXT and encoding test files — free download
Plain-text files that exercise the things text handling actually gets wrong: UTF-8 with and without a BOM, UTF-16 LE and BE, Latin-1, CRLF vs LF line endings, zero-width and right-to-left characters, and a single line long enough to break naive readers.
Need a specific size?
Streamed on demand — nothing stored, no signup, any size up to 2 GB.
16 ready-made text test files
| File | Size | What it catches | |
|---|---|---|---|
| no-trailing-newline.txt | 19 bytes | Line readers that drop the last record, and concatenation logic that glues the final line to the first line of the next file. | download |
| latin1.txt | 43 bytes | Legacy-export paths where high bytes are invalid UTF-8 sequences and decoding throws or yields U+FFFD. | download |
| shell-script.sh | 65 bytes | Upload blocklists. This should be rejected by an allowlist-based validator. If your rule is a blocklist, check that it also catches .bash, .zsh, .command and a script with no extension at all. | download |
| eicar.com.txt | 68 bytes | Whether your antivirus integration is actually wired up. Upload this and confirm the scanner quarantines it. If it lands in your bucket clean, your scanning step is not running. | download |
| windows-batch.bat | 69 bytes | The Windows half of the blocklist test. Also check .cmd, .ps1, .vbs and .scr. | download |
| gtube-spam.txt | 90 bytes | Whether the spam-filtering stage of a mail or ticketing ingest pipeline is active. | download |
| zero-width-and-rtl.txt | 94 bytes | Search and dedupe logic that treats visually identical strings as different, and UI that renders text in an order the underlying bytes do not match (Trojan Source class of bug). | download |
| utf8-no-bom.txt | 99 bytes | Readers that guess Latin-1 and mangle the umlauts, CJK and emoji into mojibake. | download |
| utf8-with-bom.txt | 102 bytes | Parsers that treat the BOM as content — the classic cause of a stray "" before the first CSV header and of JSON.parse failing on a file that looks perfectly valid in an editor. | download |
| sql-injection-payloads.txt | 157 bytes | Form fields and query parameters that concatenate rather than parameterise. Every one of these should be stored and echoed back as a literal string. | download |
| utf16be.txt | 162 bytes | Code that hardcodes little-endian after only ever testing on x86. | download |
| utf16le.txt | 162 bytes | Importers that read bytes as UTF-8 and see NUL between every character. | download |
| path-traversal-payloads.txt | 305 bytes | Path canonicalisation. A correct implementation resolves and then verifies containment; a naive one filters the literal string "../" and misses every other row in this file. | download |
| line-endings-lf.txt | 1.0 KB | The control half of the CRLF comparison. | download |
| line-endings-crlf.txt | 1.0 KB | Line-based diffing, checksum comparison and CSV parsing that assumes LF. Pair with line-endings-lf.txt: the two must produce identical parsed rows. | download |
| very-long-single-line.txt | 1000 KB | Line-buffered readers that allocate unboundedly, editors that hang, and log shippers with a per-line size cap that silently truncate. | download |
Every file is generated from source — no third-party copyright — and each has its own page with a published SHA-256 you can verify after download.
Questions
What is a BOM and why does it break my CSV?
A byte-order mark is an invisible marker at the start of a file declaring its encoding. In UTF-8 it is optional, and a parser that does not strip it sees the first column named id instead of id.
What is the difference between CRLF and LF?
Windows ends lines with carriage-return + line-feed; macOS and Linux use line-feed alone. The mismatch breaks diffs, checksums and line-by-line parsers. Both files are below.
How do I get a large text file?
Use the generator links above — plain text of any size up to 2 GB, streamed on demand.
Why are a .sh and a .bat listed here?
Because both are plain text with an executable extension, which is the pair most upload allow-lists are meant to reject. Neither script does anything harmful when run; they exist so you can confirm your filter blocks the extension rather than sniffing the (perfectly innocent) contents.