Characters allowed at hostname
⚠ Browser differences
Checks what characters can be used as valid URL hostname
Created byd0ge
Created Jun 11, 2024
Updated May 27, 2025
Detecting browser...
CategoryXSS Execution
VisibilityPublic
TypeJS
CharsetUTF-8
Code used before fuzz:
const chars = "abcdefghijklmnopqrstuvwxyz0123456789!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";0x0D
let encodings = new Map();0x0D
for (let i = 0; i < chars.length; i++) {0x0D
let c = chars[i];0x0D
for (let i = 127; i < 65536; i++) {0x0D
let str = String.fromCodePoint(i);0x0D
try {0x0D
let payload = `http://${str}example.com`;0x0D
let u = new URL(payload);0x0D
if (u.hostname === `${c}example.com`) {0x0D
log(i)0x0D
}0x0D
} catch {}0x0D
}0x0D
}Template used:
31337Sample payloads
31337Fuzz results
Chrome 144.0.0.0 desktop Windows NT 10.0
Updated31 Jan 2026
Found 312 results
Loading...
Chrome 143.0.0.0 desktop macOS 10.15.7older version
Updated25 Jan 2026
Found 312 results
Loading...
Firefox 147.0 desktop Linux
Updated1 Feb 2026
Found 311 results
Loading...
Firefox 126.0 desktop macOS 10.15older version
Updated11 Jun 2024
Found 311 results
Loading...
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0
Updated31 Jan 2026
Found 312 results
Loading...
Safari 17.5 desktop macOS 10.15.7
Updated11 Jun 2024
Found 314 results
Loading...