Shazzer logo

Characters allowed at hostname

⚠ Browser differences
Chrome logo 312
Firefox logo 311
Edge logo 312
Safari logo 314

Checks what characters can be used as valid URL hostname

d0ge
Created byd0ge
Created Jun 11, 2024
Updated May 27, 2025

Tweet
Detecting browser...
CategoryXSS Execution
VisibilityPublic
TypeJS
CharsetUTF-8
Code used before fuzz:
const chars = "abcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";0x0D
        let encodings = new Map();0x0D
        for (let i = 0; i < chars.length; i++) {0x0D
          let c = chars[i];0x0D
          for (let i = 127; i < 65536; i++) {0x0D
            let str = String.fromCodePoint(i);0x0D
            try {0x0D
              let payload = `http://${str}example.com`;0x0D
              let u = new URL(payload);0x0D
              if (u.hostname === `${c}example.com`) {0x0D
                log(i)0x0D
              }0x0D
            } catch {}0x0D
          }0x0D
        }
Template used:
31337

Sample payloads

31337

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop Windows NT 10.0
Updated31 Jan 2026
Found 312 results
Loading...
Chrome logo
Chrome 143.0.0.0 desktop macOS 10.15.7older version
Updated25 Jan 2026
Found 312 results
Loading...
Firefox logo
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 311 results
Loading...
Firefox logo
Firefox 126.0 desktop macOS 10.15older version
Updated11 Jun 2024
Found 311 results
Loading...
Edge logo
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0
Updated31 Jan 2026
Found 312 results
Loading...
Safari logo
Safari 17.5 desktop macOS 10.15.7
Updated11 Jun 2024
Found 314 results
Loading...