- Home
- Vectors
  - Categories
  - All vectors
  - All collections
  - Browser diffs
  - RSS
- Stats
- Network
- Tools
  - Cheat sheet
  - Unicode table
- Blog
  - Blog home
  - RSS
- What's new
- Help

NewShazzer now has an MCP server. Let Claude search, create and fuzz your vectors from Claude Desktop or Claude Code.Get an API key What's new

Decoding...

Shazzer

Shared online fuzzer

Fuzzing browsers since 2012

Made by Gareth Heyes

New Users

Popular Users

Updated

Scroll-driven animations
Speech recognition
Tags that consume markup but select consumes them
Scoped custom element registries
Entities after protocol-relative URL
URL domain dot alternatives
Characters allowed before onerror events
characters after slash that make a http protocol
Tags that stop style
Characters allowed javascript and colon
framers event executors
Characters allowed in-between hyphens
Characters that can be inserted in the middle of the JS protocol name
Characters allowed between an object and the dot operator
Characters between < and element name
Characters allowed after hostname but don't change the hostname
Characters allowed within a hostname but don't change the hostname
Characters that can precede the javascript protocol copy
Characters allowed before optional chaining
Valid characters between function and parenthesis

New collections

Fetch with protocol relative URLs
CSS the bomb inside your inbox
Characters ignored in URL constructors
Entities in protocol relative URLs

New Vectors

Scoped custom element registries
Speech recognition
Scroll-driven animations
EXT_texture_norm16 WebGL extension
HTML-in-canvas
Tags not rendered in MathML
Tags that break out of MathML
Supported SVG by the Sanitizer
Supported MathML by the Sanitizer
Supported HTML by the Sanitizer

Most Popular

URL domain dot alternatives(9.6k)
Characters allowed javascript and colon(8.2k)
JavaScript Scheme starting with https://(7.7k)
Characters between < and element name(7.1k)
HTML entities that create ASCII characters inside a JavaScript URL(6.7k)
Characters allowed between hostname and / but don't change the hostname(6.6k)
DOM element relationships(6.5k)
Characters that can precede the javascript protocol(6.3k)
characters allowed between exclamation mark and greater then (6k)
Entities that cause an external URL before @(5.9k)

Most Liked

URL domain dot alternatives(5)
Characters that can precede the javascript protocol(4)
Characters allowed between multiple HTML attributes(4)
JavaScript Scheme starting with https://(4)
Characters allowed javascript and colon(4)
Characters allowed between hostname and / but don't change the hostname(4)
HTML entities that create ASCII characters inside a JavaScript URL(4)
Entities that cause an external URL before @(4)
Characters appended at the end of TLD within URL, which yield in the same Origin(3)
Characters that cause an external URL before @(3)

Shared disconnectedPersonalconnecting

Distributed Fuzzing

Enabled:

Status:disconnected

Your browser automatically contributes to distributed fuzzing when idle.

Personal networksign in

Log in on each browser you use and one press of Fuzz or Test fuzz runs the vector in all of them, with every browser's results side by side.

Sign in to get started

Newbie

albinowax

Fuzzing...

Error!

James Kettle

@albinowax

0 Vectors 0 Following 5 Followers

Posts Replies Likes Vectors

hackvertor

Web security researcher at PortSwigger. Author of JavaScript for Hackers, Shazzer and Hackvertor.

Device1306

j0sh99

jekyll-001

ola456