Generator functions are functions that can pause and resume execution while yielding multiple values over time. In JavaScript, they are declared with function* and return an iterator, which lets code consume a sequence lazily rather than all at once.
How generator functions work
Generator functions pause at each yield and resume from the same point when the caller asks for the next item. That makes them useful when a sequence is expensive to build, naturally ordered, or better consumed one value at a time instead of all at once. In JavaScript, the function returns an iterator rather than a finished collection.
This execution model changes the control flow of the code around it. A generator can produce a value, suspend internal state, and later continue with local variables and logic intact. That is what makes it different from a normal function, which runs to completion before it returns.
Why generators are useful in real code
Generators are most valuable when the consumer does not need the whole result set immediately. They support lazy evaluation, so the program can delay work until a value is actually requested. That can reduce memory use, improve responsiveness, or make it easier to stream data, walk trees, and build custom iteration patterns.
They also give developers a clean way to model stateful sequences. Instead of managing external counters or manual iteration state, the generator encapsulates the progression internally. This can make traversal logic easier to read, especially when each step depends on the outcome of the previous one.
Generator functions in JavaScript
In JavaScript, generator functions use the function* syntax and are usually consumed through the iterator protocol. Each call to next() advances execution until the next yield or until the function completes. The returned object can also support return() and throw(), which gives the caller more control over the sequence.
JavaScript generators are often paired with for...of loops, which makes them convenient for producing finite sequences without building an array first. They can also be composed with other iterables, which is useful when a pipeline needs to transform values as they flow through.
Trade-offs and common limits
Generators are not always the simplest choice. Because execution is suspended and resumed, the control flow is less direct than an ordinary function, and that can make debugging harder if the sequence has many branches or side effects. They are also a poor fit when the caller truly needs a complete, immediately materialized result.
Another practical limit is that generators describe iteration, not parallelism. They are about sequencing work over time, not running work concurrently. For code that needs async behaviour, developers often use async generators or other asynchronous patterns instead of a plain generator function.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Lazy iteration changes how sequences and resources are tracked. |
| Recommendation — Inventory generator-driven resource use so deferred work remains visible and accountable. | ||
| NIST SP 800-53 Rev 5 | CM-2 — Baseline Configuration | Generator behavior depends on predictable runtime and language configuration. |
| Recommendation — Define and maintain a controlled runtime baseline for generator-heavy code paths. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Generators affect control flow and can shape code clarity, correctness, and maintainability. |
| Recommendation — Review generator usage for clear control flow and safe state handling in application code. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org