XSS Vulnerability Checker
Find XSS sinks in front-end and server code: innerHTML, document.write, dangerouslySetInnerHTML, v-html, Html.Raw and unescaped templates. Free and private:…
Paste JavaScript, React, Vue, Angular, Razor or template code to find places where untrusted data could become executable HTML.
Runs entirely in your browser. Code, keys and tokens are never uploaded, logged or stored.
Use cases
- Spot-check a snippet during code review.
- Teach a team what the risky pattern looks like.
- Double-check a fix before you push it.
Frequently asked questions
What is the safest way to show user input?
Insert it as text (textContent, normal JSX/template interpolation). If you must render HTML, sanitise it with a library such as DOMPurify.
Is the XSS Vulnerability Checker free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
Does a clean result mean my code is secure?
No. It means none of the common patterns this tool looks for were found in the snippet. Combine it with code review, dependency scanning and a full repository scan.
Related tools
Catch secrets, injection and unsafe code in every pull request with CodeInspector.