Characters urlencoded that get transformed when using the credentials part of the URL

⚠ Browser differences

This vector shows which characters that are URL decoded in the credentials part

Created Sep 24, 2024

Updated May 27, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

const anchor = document.createElement('a');

Template used:

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint($[i]));0x0D
if(!/%/.test(anchor+''))log($[i])

Sample payloads

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(33));0x0D
if(!/%/.test(anchor+''))alert(33)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(40));0x0D
if(!/%/.test(anchor+''))alert(40)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(41));0x0D
if(!/%/.test(anchor+''))alert(41)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(42));0x0D
if(!/%/.test(anchor+''))alert(42)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(45));0x0D
if(!/%/.test(anchor+''))alert(45)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(46));0x0D
if(!/%/.test(anchor+''))alert(46)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(48));0x0D
if(!/%/.test(anchor+''))alert(48)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(49));0x0D
if(!/%/.test(anchor+''))alert(49)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(50));0x0D
if(!/%/.test(anchor+''))alert(50)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(51));0x0D
if(!/%/.test(anchor+''))alert(51)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(52));0x0D
if(!/%/.test(anchor+''))alert(52)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(53));0x0D
if(!/%/.test(anchor+''))alert(53)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(54));0x0D
if(!/%/.test(anchor+''))alert(54)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(55));0x0D
if(!/%/.test(anchor+''))alert(55)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(56));0x0D
if(!/%/.test(anchor+''))alert(56)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(57));0x0D
if(!/%/.test(anchor+''))alert(57)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(65));0x0D
if(!/%/.test(anchor+''))alert(65)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(66));0x0D
if(!/%/.test(anchor+''))alert(66)

anchor.href='//example.com';0x0D
anchor.username = encodeURIComponent(String.fromCodePoint(67));0x0D
if(!/%/.test(anchor+''))alert(67)