hardcoding

basicwidespread

Hardcoding is when data—such as a price, address, or password—is written directly into the program's code, so it can only be changed by rewriting the program.

In plain terms

Imagine a restaurant that does not print its prices on the menu but engraves them into the wall. As long as nothing changes, this works perfectly. But when the breaded pork cutlet gets more expensive, printing a new sheet is not enough: you have to engrave again. Hardcoding is the same in software: the changing data is written into the program's text, not into an easily replaceable place.

Developers do this because it is fast and simple. If a working solution is needed now, it is obvious to hard-code that VAT is 27 percent or that notifications go to this single email address. The problem comes later: the value changes, and no one knows at how many points in the program it appears.

The opposite is when data lives outside the program: in a configuration file, database, or user interface, where it can be changed without a programmer. Not every hard-coded value is a bug: what never changes (a week has seven days) can safely be written in. The problem begins where data can change, or is secret.

How it works

The developer (or a coding agent) writes a specific value into the code when creating a program: a number, text, file path, URL, or password.
From now on, the program always works with this value, regardless of who uses it or where it runs.
If a value needs to change, someone must find all its occurrences in the code, rewrite them, and then release the program again.
If a fix is missed in one place, one part of the program calculates with the old value and another with the new, leading to hard-to-detect errors.
Prevention means storing variable data in configuration files or databases, while passwords and keys go into a secure secret store, with code only referencing them.

An everyday example

On January 1st, a fee rate changes, but the webshop still calculates with the old amount for days because the value was hardcoded, requiring a developer to fix it. The same occurs when an app, after a language switch, still displays a button label in Hungarian: that single text was hardcoded into the code.

Who is affected

developerIt must decide what stays in the code and what goes into configuration, and it is also responsible for ensuring that passwords or keys do not end up in the source code. → Code

entrepreneur, executiveIf prices, deadlines, or addresses are hard-coded in the ordered software, you must pay a developer for every tiny change.

everyonePasswords and access keys written into code are common causes of data breaches, in which your data may also be involved.

A common misconception

MythHardcoding is always negligence; a good program contains no hardcoded values.

In realityIt is perfectly fine to hardcode truly constant values; indeed, excessive configurability can make a program complex. The error occurs when variable or secret data is placed there.

Limits and risks

A password or API key written into the code is readable by anyone with access to the source code, and remains in the version history even after deletion.
Hardcoded values often cause errors months or years later when circumstances change, and by then no one remembers them.
Coding agents and AI assistants are also prone to hardcoding: sometimes, instead of the actual solution to the task, they enter the result expected by the test, so code written by them should be specifically checked for this.
What works on one machine can break on another if the program contains hard-coded paths or addresses specific to that machine.

Similar, but not the same

configuration – Configuration is a setting stored outside the program that can be changed without rewriting the code, which is exactly what replaces hardcoding.
default value – The default value is only a starting point that the user can override, whereas a hard-coded value cannot be changed from outside the program.
konstans – A constant value specified in a single location, identified by a constant name. It is also in the code, so modifying it requires rewriting the program, but it needs to be done in only one place, and the name reveals what the value means.

Related concepts

Broader

programming, source code, technical debt

Narrower

hardcoded password, magic number

On the edge

configuration, environment variable, API key, code review, refactoring

A brief history

The term originates from programming jargon: "hard" indicates that the value is embedded rigidly and is difficult to change. The exact year of its origin is unknown; it has been used since the early decades of computing.

Where things stand

The term belongs to the basic vocabulary of software development; secrets written into code are now sought by automated checking tools. By the end of 2026, it has returned to the forefront due to the spread of AI-written code, as coding agents regularly produce it.

Status: 2026 November

Also known as

hardcoding · hardcoding · hard coding · hard-coding · hardcode · hardcoded · hardcoding · hard-coded value

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.