Characters that cause exceptions when URL encoded

This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.

Shazzer Master

Created Oct 3, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

try{0x0D
   encodeURIComponent(String.fromCodePoint($[i]))0x0D
} catch {0x0D
   log($[i]);0x0D
}

Sample payloads

try{0x0D
   encodeURIComponent(String.fromCodePoint(55296))0x0D
} catch {0x0D
   alert(55296);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55297))0x0D
} catch {0x0D
   alert(55297);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55298))0x0D
} catch {0x0D
   alert(55298);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55299))0x0D
} catch {0x0D
   alert(55299);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55300))0x0D
} catch {0x0D
   alert(55300);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55301))0x0D
} catch {0x0D
   alert(55301);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55302))0x0D
} catch {0x0D
   alert(55302);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55303))0x0D
} catch {0x0D
   alert(55303);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55304))0x0D
} catch {0x0D
   alert(55304);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55305))0x0D
} catch {0x0D
   alert(55305);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55306))0x0D
} catch {0x0D
   alert(55306);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55307))0x0D
} catch {0x0D
   alert(55307);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55308))0x0D
} catch {0x0D
   alert(55308);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55309))0x0D
} catch {0x0D
   alert(55309);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55310))0x0D
} catch {0x0D
   alert(55310);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55311))0x0D
} catch {0x0D
   alert(55311);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55312))0x0D
} catch {0x0D
   alert(55312);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55313))0x0D
} catch {0x0D
   alert(55313);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55314))0x0D
} catch {0x0D
   alert(55314);0x0D
}

try{0x0D
   encodeURIComponent(String.fromCodePoint(55315))0x0D
} catch {0x0D
   alert(55315);0x0D
}