Characters allowed as a tag name using DOM APIs

⚠ Browser differences

This shows which characters are allowed as a tag name with the document.createElement API.

Created Jun 13, 2025

Updated Jun 13, 2025

Detecting browser...

CategoryXSS Execution

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

try{0x0D
document.createElement(String.fromCodePoint($[i]));0x0D
log($[i])0x0D
} catch{}

Sample payloads

try{0x0D
document.createElement(String.fromCodePoint(58));0x0D
alert(58)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(95));0x0D
alert(95)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(170));0x0D
alert(170)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(181));0x0D
alert(181)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(186));0x0D
alert(186)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(902));0x0D
alert(902)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(908));0x0D
alert(908)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(986));0x0D
alert(986)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(988));0x0D
alert(988)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(990));0x0D
alert(990)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(992));0x0D
alert(992)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(1369));0x0D
alert(1369)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(1749));0x0D
alert(1749)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2365));0x0D
alert(2365)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2482));0x0D
alert(2482)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2654));0x0D
alert(2654)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2701));0x0D
alert(2701)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2749));0x0D
alert(2749)0x0D
} catch{}

try{0x0D
document.createElement(String.fromCodePoint(2784));0x0D
alert(2784)0x0D
} catch{}