Seeding...

Characters Allowed Between Protocol // and localhost Where Host Still Equals localhost

This vector will test what characters can be inserted between the protocol separator (//) and the domain (localhost) in a URL (e.g., https://{X}localhost/endpoint) while still allowing the browser to resolve the host property as "localhost".

Novice Fuzzer

Created byrootd4ddy

Created Mar 2, 2025

Updated Aug 7, 2026

Unable to render tweet button

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

if (new URL("https://$[chr]localhost/endpoint").host == "localhost") {
    log($[i]);
}

Sample payloads

if (new URL("https://0x09localhost/endpoint").host == "localhost") {
    alert(9);
}

if (new URL("https:///localhost/endpoint").host == "localhost") {
    alert(47);
}

if (new URL("https://@localhost/endpoint").host == "localhost") {
    alert(64);
}

if (new URL("https://\localhost/endpoint").host == "localhost") {
    alert(92);
}

if (new URL("https://localhost/endpoint").host == "localhost") {
    alert(173);
}

if (new URL("https://͏localhost/endpoint").host == "localhost") {
    alert(847);
}

if (new URL("https://ᅟlocalhost/endpoint").host == "localhost") {
    alert(4447);
}

if (new URL("https://ᅠlocalhost/endpoint").host == "localhost") {
    alert(4448);
}

if (new URL("https://឴localhost/endpoint").host == "localhost") {
    alert(6068);
}

if (new URL("https://឵localhost/endpoint").host == "localhost") {
    alert(6069);
}

if (new URL("https://᠋localhost/endpoint").host == "localhost") {
    alert(6155);
}

if (new URL("https://᠌localhost/endpoint").host == "localhost") {
    alert(6156);
}

if (new URL("https://᠍localhost/endpoint").host == "localhost") {
    alert(6157);
}

if (new URL("https://᠎localhost/endpoint").host == "localhost") {
    alert(6158);
}

if (new URL("https://᠏localhost/endpoint").host == "localhost") {
    alert(6159);
}

if (new URL("https://localhost/endpoint").host == "localhost") {
    alert(8203);
}

if (new URL("https://⁠localhost/endpoint").host == "localhost") {
    alert(8288);
}

if (new URL("https://⁡localhost/endpoint").host == "localhost") {
    alert(8289);
}

if (new URL("https://⁢localhost/endpoint").host == "localhost") {
    alert(8290);
}

if (new URL("https://⁣localhost/endpoint").host == "localhost") {
    alert(8291);
}