Spoofing...

Characters allowed as a tag name using DOM APIs

⚠ Browser differences

This shows which characters are allowed as a tag name with the document.createElement API.

Created byhackvertor

Created Jun 13, 2025

Updated Jun 13, 2025

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

try{0x0D
document.createElement(String.fromCodePoint($[i]));0x0D
log($[i])0x0D
} catch{}

Sample payloads

try{0x0D
document.createElement(String.fromCodePoint(58));0x0D
alert(58)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(95));0x0D
alert(95)0x0D
} catch{}