Corpus-building...

Characters allowed as a tag name using DOM APIs

⚠ Browser differences

This shows which characters are allowed as a tag name with the document.createElement API.

Shazzer Master

Created byhackvertor

Created Jun 13, 2025

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

try{
document.createElement(String.fromCodePoint($[i]));
log($[i])
} catch{}

Sample payloads

try{
document.createElement(String.fromCodePoint(58));
alert(58)
} catch{}

try{
document.createElement(String.fromCodePoint(95));
alert(95)
} catch{}