🎭 XSS Payload Tester

Test XSS payloads safely with HTML entity encoding and preview. Educational purposes only.

Web & Cloud Security

XSS Payload Input

HTML Entity Encoded (Safe)

Encoded output will appear here...

Analysis

Payload length: 0 characters

Detected tags: None

Detected event handlers: None

Risk level: Low

⚠️ Educational Only: This tool is for learning about XSS vulnerabilities. Never use XSS attacks on websites you don't own or have permission to test.

', '', '', '"> ', '', '', 'Click me' ]; function testPayload() { const payload = document.getElementById('payload').value; const encodedEl = document.getElementById('encoded'); if (!payload) { encodedEl.className = 'output-display error'; encodedEl.textContent = 'Error: Please enter a payload.'; return; } // HTML Entity encode (safe) const encoded = payload .replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); encodedEl.className = 'output-display success'; encodedEl.textContent = encoded; // Analysis const tags = (payload.match(/<[^>]+>/g) || []).join(', ') || 'None'; const events = (payload.match(/on\w+\s*=/gi) || []).join(', ') || 'None'; const hasScript = /