Fuzz Testing in Pest 5 for Laravel Developers | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ home ](https://www.msaied.com) [ articles ](https://www.msaied.com/articles) Find Unexpected Test Inputs with Fuzz for Pest On this page 1. [ What Is Fuzz Testing? ](#what-is-fuzz-testing) 2. [ How Coverage-Guided Fuzzing Works ](#how-coverage-guided-fuzzing-works) 3. [ Installation ](#installation) 4. [ A Practical Example ](#a-practical-example) 5. [ What Fuzz Found ](#what-fuzz-found) 6. [ What the Test Actually Checks ](#what-the-test-actually-checks) 7. [ Fitting Fuzz Into Your Workflow ](#fitting-fuzz-into-your-workflow) 8. [ Key Takeaways ](#key-takeaways) ![Find Unexpected Test Inputs with Fuzz for Pest](https://cdn.msaied.com/644/a8804395d4fd322b55d91a7dd9e6ffa3.png) [ Composer Pacakge ](https://www.msaied.com/articles?category=composer-pacakge) [ PHP ](https://www.msaied.com/articles?category=php) #Pest #Fuzz Testing #Laravel Testing #PHP #Package Find Unexpected Test Inputs with Fuzz for Pest ================================================ 7 Sep 2026 4 min read ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said Table of contents 1. [ 01 What Is Fuzz Testing? ](#what-is-fuzz-testing) 2. [ 02 How Coverage-Guided Fuzzing Works ](#how-coverage-guided-fuzzing-works) 3. [ 03 Installation ](#installation) 4. [ 04 A Practical Example ](#a-practical-example) 5. [ 05 What Fuzz Found ](#what-fuzz-found) 6. [ 06 What the Test Actually Checks ](#what-the-test-actually-checks) 7. [ 07 Fitting Fuzz Into Your Workflow ](#fitting-fuzz-into-your-workflow) 8. [ 08 Key Takeaways ](#key-takeaways) What Is Fuzz Testing? --------------------- A conventional test suite covers the cases you think of: a valid string, an empty one, maybe a boundary value. Fuzz testing takes a different approach — it generates and mutates inputs automatically, then passes them to your code looking for failures you never anticipated. [Fuzz](https://github.com/JonPurvis/fuzz), a package by Jon Purvis, brings this technique directly into [Pest 5](https://laravel-news.com/pest-5) tests. Under the hood it uses nikic's PHP-Fuzzer to mutate strings and report any failures through Pest's familiar output. How Coverage-Guided Fuzzing Works --------------------------------- A basic fuzzer mutates an input — adding, removing, or replacing characters — and runs your code with the result. A **coverage-guided** fuzzer goes further: it watches which code paths each input exercises. When a mutated input reaches a previously unexplored branch, the fuzzer saves it to a **corpus** and uses it as the basis for further mutations. This matters for code with successive validation steps. Once an input passes the first check, the fuzzer can focus on mutating strings that reach the second check, and so on. PHP-Fuzzer tracks transitions between PHP code blocks to collect this feedback. Fuzz handles the instrumentation for you — no Xdebug or `--coverage` flag required. Installation ------------ Fuzz requires PHP 8.4+ and Pest 5. Install it as a dev dependency: ```bash composer require jonpurvis/fuzz --dev ``` A Practical Example ------------------- Consider a helper that parses a rate-limit spec like `100/60s` into requests per second: ```php namespace App; final class RateLimit { public static function perSecond(string $spec): float { $parts = explode('/', $spec); $count = (int) $parts[0]; $window = (int) rtrim($parts[1] ?? '1s', 's'); return $count / $window; } } ``` The helper does no input validation. A fuzz test can probe it for crashes: ```php use App\RateLimit; use function Fuzz\fuzz; $target = static function (string $input): void { RateLimit::perSecond($input); }; test('rate limit spec parser never fatals', function () use ($target): void { fuzz($target) ->seed(['100/60s', '5/1s', '1000/3600s']) ->withDictionary(['/', 's', '0', '1']) ->runs(2000) ->maxLen(16) ->run('rate-limit-parser'); }); ``` - `seed()` — starting examples the fuzzer mutates from. - `withDictionary()` — fragments the fuzzer may insert (does not restrict other characters). - `runs()` — total mutation budget. - `maxLen()` — maximum byte length of generated strings. - `run()` — unique name used to separate corpus and crash files. **Important:** define `$target` outside `test()`. Fuzz runs the closure in a separate PHP process where Pest's generated test class is unavailable; keeping it outside avoids that dependency and ensures coverage is recorded correctly. ### What Fuzz Found In a test run, Fuzz produced the input `5/`. The missing window segment becomes an empty string, PHP casts it to `0`, and dividing by zero throws a `DivisionByZeroError`. Pest reports the test as failed. The crashing input is saved under `.pest/fuzz-crashes/` so you can reproduce and fix it. What the Test Actually Checks ----------------------------- By default, Fuzz fails on `TypeError`, unsuppressed PHP warnings and notices, and division-by-zero errors. Ordinary exceptions — including Laravel validation exceptions — are ignored unless you use the `allow()` method to opt specific exception types in. To catch wrong return values as well as crashes, add a Pest expectation inside the target closure. For example, an encode/decode round-trip test could assert that decoding an encoded string always returns the original value. A per-input timeout is available via `timeout()`, which requires the `pcntl` extension. Fitting Fuzz Into Your Workflow ------------------------------- Fuzz complements, rather than replaces, your regular tests and datasets. Use it when code accepts a wide range of possible inputs — parsers, format converters, user-supplied text handlers — where listing every edge case by hand is impractical. - Keep a small run budget (`runs`) in your normal test suite for fast feedback. - Run a larger budget in a scheduled CI job for deeper exploration. - After fixing a crash, add the failing input to a named dataset so regression is caught by ordinary tests. ### Key Takeaways - Fuzz for Pest wraps PHP-Fuzzer with a clean Pest 5 API. - Coverage-guided mutation finds inputs that reach new code branches automatically. - No Xdebug or `--coverage` flag needed — instrumentation is built in. - Failing inputs are saved to `.pest/fuzz-crashes/` for easy reproduction. - Define the target closure outside `test()` to ensure coverage recording works. - Combine fuzz tests with conventional datasets for complete coverage. --- *Source: [Find Unexpected Test Inputs with Fuzz for Pest — Laravel News](https://laravel-news.com/pest-fuzz)* Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Ffind-unexpected-test-inputs-with-fuzz-for-pest&text=Find+Unexpected+Test+Inputs+with+Fuzz+for+Pest) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Ffind-unexpected-test-inputs-with-fuzz-for-pest) Frequently Asked Questions ---------------------------- 3 questions Q01 What PHP and Pest versions does the Fuzz package require? Fuzz requires PHP 8.4 or higher and Pest 5. Install it as a dev dependency with `composer require jonpurvis/fuzz --dev`. Q02 Why should the fuzz target closure be defined outside the `test()` block? Fuzz runs the closure in a separate PHP process where Pest's generated test class is not available. Defining the closure outside `test()` avoids that dependency and ensures coverage is recorded correctly by PHP-Fuzzer. Q03 What kinds of failures does Fuzz detect by default? By default, Fuzz reports TypeError, unsuppressed PHP warnings and notices, and errors such as DivisionByZeroError. Ordinary exceptions, including Laravel validation exceptions, are ignored unless you explicitly opt them in with the `allow()` method. Continue reading More Articles --------------- [ View all ](https://www.msaied.com/articles) [ ![Chunked Iteration, Lazy Collections, and Cursor Pagination at Scale in Laravel](https://cdn.msaied.com/645/3bcda55cd0d9e4e9b4be38c9b3d11ea4.png) laravel eloquent performance ### Chunked Iteration, Lazy Collections, and Cursor Pagination at Scale in Laravel Processing millions of Eloquent rows without exhausting memory requires the right tool for the job. Learn when... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 8 Sep 2026 4 min read Read ](https://www.msaied.com/articles/chunked-iteration-lazy-collections-and-cursor-pagination-at-scale-in-laravel) [ ![PostgreSQL JSONB in Laravel: Indexing, Querying, and Casting Without the Pain](https://cdn.msaied.com/643/656efe6f0c30b559bcdb27456edcc366.png) laravel postgresql eloquent ### PostgreSQL JSONB in Laravel: Indexing, Querying, and Casting Without the Pain JSONB columns unlock flexible schemas inside PostgreSQL, but misused they become slow blobs. Learn how to inde... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 8 Sep 2026 3 min read Read ](https://www.msaied.com/articles/postgresql-jsonb-in-laravel-indexing-querying-and-casting-without-the-pain-2) [ ![Filament v5.8.0 Released: Deferred Schema Loading, Session Grouping & More](https://cdn.msaied.com/641/eccc2db7462422ed6a5dd3dbbf991a28.png) Filament Laravel PHP ### Filament v5.8.0 Released: Deferred Schema Loading, Session Grouping & More Filament v5.8.0 ships deferred schema loading, persistent table grouping, RichEditor height controls, a reusab... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 7 Sep 2026 4 min read Read ](https://www.msaied.com/articles/filament-v580-released-deferred-schema-loading-session-grouping-more) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [Contact](https://www.msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)