Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for


The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML.


But where does javascript:alert(0) come from? From my research colons are used for labeling anonymous functions and object literals but not sure if it's the same with this payload.

  • Related: stackoverflow.com/questions/925734/…
    – mti2935
    Commented May 13, 2021 at 16:54
  • 1
    It works in links in place of the URL. It used to work in address bars too, but I guess not in every browser anymore.
    – reed
    Commented May 13, 2021 at 17:08

1 Answer 1


javascript: is the URI scheme (like http: or https: or ftp: or file:) for immediate-execution javascript. Javascript URIs can be set as the "URL" of a window, both the top-level window or an iframe/popup/etc. They execute in the context of the currently-loaded origin and page, so it's equivalent to injecting a script tag into the page.

Outside of malicious operations (such as excessively open redirects), javascript: URIs are usually used for "bookmarklets", where you create a bookmark in your browser that contains a little bit of script you might want to run on an arbitrary page. Then, when you're on the page, you can "go to" the bookmarklet, which just runs that script snippet on the page. An amusing example is featured on this page: http://kathack.com/

From a security perspective, javascript: URIs are usually not commonly used in attacks, but sometimes they're the most practical option. If you can control the location of a window, but nothing else, javascript: URIs are an option (along with data: URIs) for injecting arbitrary content into the page context. Most other times, it's easier to manipulate the actual HTML, though (by injecting a script tag, or an HTML element with event handlers, or changing the content of an existing JS block / invocation).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .