XSS Detector
Scan user input or HTML for Cross-Site Scripting vectors — script tags, inline event handlers, javascript:/data: URIs, SVG and CSS vectors, DOM sinks, and encoded payloads — each graded by severity with a line/column location and a fix. Then see your input correctly encoded for any output context (HTML, attribute, JS, URL, CSS), with framework-safe output snippets. Switch to Reference mode for a categorized payload + encoding cheat-sheet.
About this ToolHow it works, benefits & use casesTap to collapse
A two-in-one Cross-Site Scripting toolkit. In Scan mode you paste user input or an HTML fragment and the detector matches it against categorized XSS vectors — script tags, inline event handlers (onerror, onload, onclick, ...), javascript: and vbscript: URIs, data:text/html payloads, SVG vectors (embedded scripts, animate handlers, foreignObject), CSS vectors (expression(), url(javascript:), @import), DOM sinks (innerHTML, document.write, eval, string-argument timers), dangerous elements (iframe, object, embed, base, meta-refresh, form action), and encoded or obfuscated forms (HTML entities, URL-percent, unicode and hex escapes). Each finding reports its category, a severity badge (critical, high, medium, low), the matched snippet, and the exact line and column, and the results roll up into per-severity counts. Below that, a context-aware encoder shows your input correctly escaped for HTML body, HTML attribute, JavaScript string, URL, or CSS contexts, side by side with the raw input, plus framework-safe output snippets for React/JSX, vanilla DOM textContent, a DOMPurify allowlist config, and a server-side note. Reference mode is a categorized payload and encoding cheat-sheet: every entry pairs a representative payload with what it exploits and how to fix it, followed by an output-encoding rules table. Everything runs locally in your browser and the tool never injects any payload into the page — every snippet is rendered as escaped text.
How to Use
- 1In Scan mode, paste the text or HTML you want to check, or click Load example.
- 2Click Scan for XSS to get categorized findings with severity, line/column, and a fix for each.
- 3Pick an output context (HTML body, attribute, JS string, URL, or CSS) to see your input correctly encoded side by side with the raw input.
- 4Review the framework-safe output snippets (React, DOM textContent, DOMPurify, server-side) and apply them.
- 5Switch to Reference mode for a categorized payload-and-fix cheat-sheet plus an output-encoding rules table.
Key Benefits
- Categorized detection across nine vector families, each finding graded by severity
- Line and column location plus a concrete fix for every match
- Context-aware encoder: HTML body, attribute, JS string, URL, and CSS encodings
- Framework-safe output examples for React, vanilla DOM, DOMPurify, and the server
- Reference cheat-sheet pairing real payloads with what they exploit and how to fix them
- Runs entirely in the browser and never injects payloads — snippets are shown as escaped text
Common Use Cases
- Triaging a suspected payload from a bug report or pentest finding
- Sanity-checking user-supplied HTML before rendering it in an app
- Picking the correct output encoding for the context a value lands in
- Teaching a team which HTML, URL, and DOM constructs are dangerous and why
- Spotting encoded or obfuscated injection attempts during code review
Paste user-supplied input or an HTML fragment. Everything runs locally in your browser.
About Cross-Site Scripting (XSS)
XSS attacks inject malicious scripts into web pages viewed by other users
Stored XSS
Malicious script is permanently stored on the server (e.g., in a database)
Reflected XSS
Malicious script is reflected off a web server (e.g., in URL parameters)
DOM-based XSS
Vulnerability exists in client-side code rather than server-side
This is a defensive, educational aid — a clean result is not a guarantee of safety. Always combine framework auto-escaping, contextual output encoding, a strong CSP, and server-side validation.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- HTML Entity Encoder/DecoderEncode and decode HTML entities
- SQL Injection TesterAnalyze a query for injection risk with a graded report and secure rewrite, plus a categorized reference of injection classes (UNION, blind, error-based, stacked) and their defenses
- OWASP Security CheckerScan code & HTTP headers for OWASP Top 10 issues plus an interactive checklist
- SQL Injection DetectorScan SQL or application code for injection-prone patterns (string concatenation, tautologies, UNION, stacked queries) and get parameterized-query fixes for Node, Python, PHP, and Java
- CORS Header GeneratorGenerate CORS headers for API endpoints
- Unicode ConverterConvert between Unicode and text
Scan mode analyzes a specific string you paste: it reports the XSS vectors it finds, grades each by severity, gives a line and column, and shows your input encoded for whichever output context you choose. Reference mode is a static cheat-sheet — a categorized library of representative payloads, what each one exploits, and how to fix it, plus an output-encoding rules table. Use Scan to check a concrete input and Reference to learn the vectors and the right encoding for each context.
It groups matches into nine families: script tags; inline event handlers (on*); javascript:/vbscript: URIs; data:text/html URIs; SVG vectors (embedded scripts, animate/set handlers, foreignObject); CSS vectors (expression(), url(javascript:), @import); DOM sinks (innerHTML, outerHTML, insertAdjacentHTML, document.write, eval, Function, string-argument setTimeout/setInterval); dangerous elements (iframe, object, embed, base, meta-refresh, form action); and encoded or obfuscated forms (HTML entities, URL-percent, unicode and hex escapes). Each finding carries a category, severity, the matched snippet, and its line and column.