Characters allowed in between // in absolute URL
Characters allowed in between // in absolute URL
Created bybribes
Created Nov 29, 2025
Updated Nov 29, 2025
Detecting browser...
CategoryURL Handling
VisibilityPublic
TypeJS
CharsetUTF-8
Template used:
let chr = String.fromCodePoint($[i]);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && log($[i])Sample payloads
let chr = String.fromCodePoint(9);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(9)let chr = String.fromCodePoint(10);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(10)let chr = String.fromCodePoint(13);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(13)let chr = String.fromCodePoint(47);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(47)let chr = String.fromCodePoint(92);0x0D
let a = document.createElement("a");0x0D
a.href = '/'+chr+'/example.com';0x0D
new URL(a.href).host === "example.com" && alert(92)Fuzz results
Chrome 148.0.0.0 desktop Windows NT 10.0
Updated15 Mar 2026
Found 1 result
Loading...
Chrome 146.0.0.0 desktop macOS 10.15.7older version
Updated31 Mar 2026
Found 5 results
Loading...
Firefox 150.0 desktop macOS 10.15
Updated14 Mar 2026
Found 1 result
Loading...
Microsoft Edge 146.0.0.0 desktop Windows NT 10.0
Updated29 Mar 2026
Found 1 result
Loading...
Safari 26.2 desktop macOS 10.15.7
Updated29 Jan 2026
Found 1 result
Loading...