Shazzer logo

Characters that cause exceptions when URL encoded

Chrome logo 2k
Firefox logo 2k
Safari logo 2k

This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.

Created by: hackvertor

Created on: Thursday, October 3, 2024 at 11:22:50 AM

Updated on: Tuesday, May 27, 2025 at 3:36:36 PM


Category: XSS Execution

Vector visibility: Public

Vector type: JS

Vector charset: UTF-8

Template used:
try{0x0D
   encodeURIComponent(String.fromCodePoint($[i]))0x0D
} catch {0x0D
   log($[i]);0x0D
} 
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

try{0x0D
   encodeURIComponent(String.fromCodePoint(55296))0x0D
} catch {0x0D
   alert(55296);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55297))0x0D
} catch {0x0D
   alert(55297);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55298))0x0D
} catch {0x0D
   alert(55298);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55299))0x0D
} catch {0x0D
   alert(55299);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55300))0x0D
} catch {0x0D
   alert(55300);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55301))0x0D
} catch {0x0D
   alert(55301);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55302))0x0D
} catch {0x0D
   alert(55302);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55303))0x0D
} catch {0x0D
   alert(55303);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55304))0x0D
} catch {0x0D
   alert(55304);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55305))0x0D
} catch {0x0D
   alert(55305);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55306))0x0D
} catch {0x0D
   alert(55306);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55307))0x0D
} catch {0x0D
   alert(55307);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55308))0x0D
} catch {0x0D
   alert(55308);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55309))0x0D
} catch {0x0D
   alert(55309);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55310))0x0D
} catch {0x0D
   alert(55310);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55311))0x0D
} catch {0x0D
   alert(55311);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55312))0x0D
} catch {0x0D
   alert(55312);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55313))0x0D
} catch {0x0D
   alert(55313);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55314))0x0D
} catch {0x0D
   alert(55314);0x0D
} 
try{0x0D
   encodeURIComponent(String.fromCodePoint(55315))0x0D
} catch {0x0D
   alert(55315);0x0D
} 

Fuzz results

Chrome logo
Chrome 143.0.0.0 desktop macOS 10.15.7

Updated

Sun Jan 25 2026
Found 2048 results
Loading...
Firefox logo
Firefox 131.0 desktop macOS 10.15

Updated

Thu Oct 03 2024
Found 2048 results
Loading...
Safari logo
Safari 18.0 desktop macOS 10.15.7

Updated

Thu Oct 03 2024
Found 2048 results
Loading...