Characters allowed as start of HTML tag name

Characters that are possible starts of HTML tag names, for use in "custom tags" on https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Created byJorianWoltjer

Created Jan 30, 2026

Updated Jan 30, 2026

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<$[chr]a id="test">

Code used after fuzz:

document.getElementById('test') && log(i)

Sample payloads

<<a id="test">

<Aa id="test">

<Ba id="test">

<Ca id="test">

<Da id="test">

<Ea id="test">

<Fa id="test">

<Ga id="test">

<Ha id="test">

<Ia id="test">

<Ja id="test">

<Ka id="test">

<La id="test">

<Ma id="test">

<Na id="test">

<Oa id="test">

<Pa id="test">

<Qa id="test">

<Ra id="test">

<Sa id="test">

Characters allowed as start of HTML tag name

Sample payloads

Fuzz results

Distributed Fuzzing