Characters allowed between hostname and / but don't change the hostname



Checks what characters can be added between "https://example.com" and /, while keeping the hostname "example.com"
Created by: ThomasOrlita
Created on: Monday, April 15, 2024 at 11:30:20 PM
Updated on: Wednesday, May 28, 2025 at 5:06:19 PM
Vector type: JS
Vector charset: UTF-8
Template used:
if (new URL("https://example.com" + String.fromCodePoint($[i]) + "/").hostname === 'example.com'){log($[i])}
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
if (new URL("https://example.com" + String.fromCodePoint(9) + "/").hostname === 'example.com'){alert(9)}
if (new URL("https://example.com" + String.fromCodePoint(10) + "/").hostname === 'example.com'){alert(10)}
if (new URL("https://example.com" + String.fromCodePoint(13) + "/").hostname === 'example.com'){alert(13)}
if (new URL("https://example.com" + String.fromCodePoint(35) + "/").hostname === 'example.com'){alert(35)}
if (new URL("https://example.com" + String.fromCodePoint(47) + "/").hostname === 'example.com'){alert(47)}
if (new URL("https://example.com" + String.fromCodePoint(58) + "/").hostname === 'example.com'){alert(58)}
if (new URL("https://example.com" + String.fromCodePoint(63) + "/").hostname === 'example.com'){alert(63)}
if (new URL("https://example.com" + String.fromCodePoint(92) + "/").hostname === 'example.com'){alert(92)}
if (new URL("https://example.com" + String.fromCodePoint(173) + "/").hostname === 'example.com'){alert(173)}
if (new URL("https://example.com" + String.fromCodePoint(847) + "/").hostname === 'example.com'){alert(847)}
if (new URL("https://example.com" + String.fromCodePoint(6155) + "/").hostname === 'example.com'){alert(6155)}
if (new URL("https://example.com" + String.fromCodePoint(6156) + "/").hostname === 'example.com'){alert(6156)}
if (new URL("https://example.com" + String.fromCodePoint(6157) + "/").hostname === 'example.com'){alert(6157)}
if (new URL("https://example.com" + String.fromCodePoint(6159) + "/").hostname === 'example.com'){alert(6159)}
if (new URL("https://example.com" + String.fromCodePoint(8203) + "/").hostname === 'example.com'){alert(8203)}
if (new URL("https://example.com" + String.fromCodePoint(8288) + "/").hostname === 'example.com'){alert(8288)}
if (new URL("https://example.com" + String.fromCodePoint(8292) + "/").hostname === 'example.com'){alert(8292)}
if (new URL("https://example.com" + String.fromCodePoint(65024) + "/").hostname === 'example.com'){alert(65024)}
if (new URL("https://example.com" + String.fromCodePoint(65025) + "/").hostname === 'example.com'){alert(65025)}
if (new URL("https://example.com" + String.fromCodePoint(65026) + "/").hostname === 'example.com'){alert(65026)}
Fuzz results

Chrome 124.0.0.0 Unknown Unknown
Updated
Wed May 01 2024
Found 278 results
Loading...

Firefox 125.0 Unknown Unknown
Updated
Wed May 01 2024
Found 278 results
Loading...

Safari 17.4 Unknown Unknown
Updated
Wed May 01 2024
Found 278 results
Loading...

Safari 17.6 mobile iOS 17.6.1
Updated
Tue Aug 20 2024
Found 34 results
Loading...

Chrome 137.0.0.0 desktop macOS 10.15.7
Updated
Wed Jun 11 2025
Found 34 results
Loading...

Firefox 139.0 desktop macOS 10.15
Updated
Wed Jun 11 2025
Found 34 results
Loading...

Safari 18.5 desktop macOS 10.15.7
Updated
Wed Jun 11 2025
Found 302 results
Loading...