Characters that cause exceptions when URL encoded
This vector demonstrates which characters cause encodeURIComponent to throw an exception when attempting to URL encode.
Created by: hackvertor
Created on: Thursday, October 3, 2024 at 11:22:50 AM
Updated on: Tuesday, May 27, 2025 at 3:36:36 PM
Category: XSS Execution
Vector visibility: Public
Vector type: JS
Vector charset: UTF-8
Template used:
try{0x0D
encodeURIComponent(String.fromCodePoint($[i]))0x0D
} catch {0x0D
log($[i]);0x0D
} Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...
Sample payloads
try{0x0D
encodeURIComponent(String.fromCodePoint(55296))0x0D
} catch {0x0D
alert(55296);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55297))0x0D
} catch {0x0D
alert(55297);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55298))0x0D
} catch {0x0D
alert(55298);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55299))0x0D
} catch {0x0D
alert(55299);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55300))0x0D
} catch {0x0D
alert(55300);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55301))0x0D
} catch {0x0D
alert(55301);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55302))0x0D
} catch {0x0D
alert(55302);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55303))0x0D
} catch {0x0D
alert(55303);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55304))0x0D
} catch {0x0D
alert(55304);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55305))0x0D
} catch {0x0D
alert(55305);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55306))0x0D
} catch {0x0D
alert(55306);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55307))0x0D
} catch {0x0D
alert(55307);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55308))0x0D
} catch {0x0D
alert(55308);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55309))0x0D
} catch {0x0D
alert(55309);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55310))0x0D
} catch {0x0D
alert(55310);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55311))0x0D
} catch {0x0D
alert(55311);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55312))0x0D
} catch {0x0D
alert(55312);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55313))0x0D
} catch {0x0D
alert(55313);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55314))0x0D
} catch {0x0D
alert(55314);0x0D
} try{0x0D
encodeURIComponent(String.fromCodePoint(55315))0x0D
} catch {0x0D
alert(55315);0x0D
} Fuzz results
Chrome 143.0.0.0 desktop macOS 10.15.7
Updated
Sun Jan 25 2026
Found 2048 results
Loading...
Firefox 131.0 desktop macOS 10.15
Updated
Thu Oct 03 2024
Found 2048 results
Loading...
Safari 18.0 desktop macOS 10.15.7
Updated
Thu Oct 03 2024
Found 2048 results
Loading...