Replaying...

Characters allowed within a hostname but don't change the hostname

⚠ Browser differences

Checks what characters can be added in the middle of "https://example.com", while keeping the hostname "example.com"

Created byThomasOrlita

Created Apr 30, 2024

Updated May 14, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("https://example.co" + String.fromCodePoint($[i]) + "m").hostname === 'example.com'){log($[i])}

Sample payloads

if (new URL("https://example.co" + String.fromCodePoint(9) + "m").hostname === 'example.com'){alert(9)}

if (new URL("https://example.co" + String.fromCodePoint(10) + "m").hostname === 'example.com'){alert(10)}

if (new URL("https://example.co" + String.fromCodePoint(13) + "m").hostname === 'example.com'){alert(13)}

if (new URL("https://example.co" + String.fromCodePoint(173) + "m").hostname === 'example.com'){alert(173)}

if (new URL("https://example.co" + String.fromCodePoint(847) + "m").hostname === 'example.com'){alert(847)}

if (new URL("https://example.co" + String.fromCodePoint(4447) + "m").hostname === 'example.com'){alert(4447)}

if (new URL("https://example.co" + String.fromCodePoint(4448) + "m").hostname === 'example.com'){alert(4448)}

if (new URL("https://example.co" + String.fromCodePoint(6068) + "m").hostname === 'example.com'){alert(6068)}

if (new URL("https://example.co" + String.fromCodePoint(6069) + "m").hostname === 'example.com'){alert(6069)}

if (new URL("https://example.co" + String.fromCodePoint(6155) + "m").hostname === 'example.com'){alert(6155)}

if (new URL("https://example.co" + String.fromCodePoint(6156) + "m").hostname === 'example.com'){alert(6156)}

if (new URL("https://example.co" + String.fromCodePoint(6157) + "m").hostname === 'example.com'){alert(6157)}

if (new URL("https://example.co" + String.fromCodePoint(6158) + "m").hostname === 'example.com'){alert(6158)}

if (new URL("https://example.co" + String.fromCodePoint(6159) + "m").hostname === 'example.com'){alert(6159)}

if (new URL("https://example.co" + String.fromCodePoint(8203) + "m").hostname === 'example.com'){alert(8203)}

if (new URL("https://example.co" + String.fromCodePoint(8288) + "m").hostname === 'example.com'){alert(8288)}

if (new URL("https://example.co" + String.fromCodePoint(8289) + "m").hostname === 'example.com'){alert(8289)}

if (new URL("https://example.co" + String.fromCodePoint(8290) + "m").hostname === 'example.com'){alert(8290)}

if (new URL("https://example.co" + String.fromCodePoint(8291) + "m").hostname === 'example.com'){alert(8291)}

if (new URL("https://example.co" + String.fromCodePoint(8292) + "m").hostname === 'example.com'){alert(8292)}