Corrupt & Invalid File Generator

Why Test With Broken Files?

Most file-handling bugs live in the error path. An upload form that accepts a valid PDF tells you little; what matters is what happens when someone sends half a PDF, a PNG renamed to .pdf, a password-protected document or a server's 404 page saved as invoice.xlsx. Each file here is broken in one documented way, so when a test fails you know exactly which check is missing.

• Upload validation — does your form check the content (magic bytes) or only trust the extension and the browser's MIME type?
• Parsers and converters — do PDF, image and Office libraries raise a clean, catchable error, or crash the worker?
• Error messages — does the user see "this file is damaged" or a 500 page?
• Security scanners and queues — do password-protected and malformed files get quarantined, retried forever, or silently dropped?

What the Result Types Mean

Every case was opened with real libraries (listed below). The result type says what they did, so you know what to expect from yours:

• Unreadable — every reader we tested rejects it.
• Some readers reject — strict parsers fail while forgiving ones repair or accept it. A truncated PDF is the classic example: pypdf in strict mode refuses it, MuPDF and browsers rebuild what they can.
• Opens anyway — most software opens it, so only a validator that checks for this exact problem catches it.
• Password — a valid file that can't be opened without the password (it's test for every protected sample).
• Valid edge case — a correct file with something your code may not expect: a PDF with no pages, an empty ZIP, a PDF that forbids copying.

Every Defect, Format by Format

15 formats, 45 kinds of defect, 130 combinations. Click any defect to load it into the generator.

How Each File Is Checked

The result types aren't guesses. Every combination was generated at five or more sizes, from 1 byte to 600 KB, and opened with these readers on 10 October 2026: pypdf 6.14 in strict mode and PyMuPDF 1.28 for PDF; Pillow 12.1 (strict, then with truncated images allowed) for PNG, JPG, GIF and TIFF; Python 3.11's zipfile, wave, json and xml.etree; lxml 6.1; pandas 3.0 and Python's csv module; python-docx 1.2, openpyxl 3.1 and python-pptx 1.0 for Office files; and JSON.parse in Node 22 and Microsoft Edge. Your libraries may be stricter or more forgiving, which is exactly what these files help you find out.

Using a Test Pack in CI

Download test pack builds one ZIP per format: a valid control file, one file per defect, a README.txt and a manifest.json that lists each file's defect, result type, size, SHA-256 and password. Commit it as fixtures and drive a parametrised test from the manifest:

import json, pathlib, pytest
from myapp.uploads import validate_upload, InvalidFile

pack = pathlib.Path("fixtures/pdf")
cases = json.loads((pack / "manifest.json").read_text())

@pytest.mark.parametrize("case", cases, ids=lambda c: c["defect"])
def test_upload(case):
    data = (pack / case["file"]).read_bytes()
    if case["kind"] == "valid":
        validate_upload(data)
    elif case["kind"] in ("unreadable", "strict"):
        with pytest.raises(InvalidFile):
            validate_upload(data)

Add a seed and the pack is reproducible byte for byte, so you can regenerate it in another branch and compare hashes.

What This Tool Deliberately Doesn't Make

• No malware or antivirus test files. If you need to check that a scanner fires, use the industry-standard test file from EICAR instead.
• No zip bombs, XML entity bombs or XXE payloads, path-traversal archives, macros or executables. Those are attack payloads, not QA fixtures, and they belong in a controlled security test.
• No "corrupt my file" upload. Every file is synthetic. The tool won't damage a document you already have — that is mostly used to send someone a broken file on purpose.

Need files that are valid at an exact size instead? Use the Sample File Generator.