HTML Viewer
Paste HTML into the left box and the page renders on the right, in a frame that cannot run any of it. The viewers on this search render pasted markup with scripts live, which is fine for code you wrote yourself and a real risk for a page somebody sent you, because a script in it runs the moment you look. Here the frame is given one permission, same-origin, and the document it renders carries a content policy that starts from default-src 'none', so no script executes, no form submits, no popup opens, nothing navigates away on its own and no request is made for the pictures, stylesheets, fonts or nested pages the markup references. Your source is not cleaned up, escaped or rewritten on the way in: it is rendered exactly as pasted, which is the whole point of looking at it. Because a sealed preview does make some pages look wrong, the list under the stage counts what this document actually asked for, whether that is a script, a form, a nested page, a picture, a stylesheet or a web font, so a missing logo is explainable rather than mysterious, and the heading outline beside it gives you the shape of the page at a glance.
Preview
Rendered output appears here.
Nothing to render yet.
Scripts never runNothing is fetched for the previewYour HTML stays in this tabNo account, no sign-up
The preview is empty. Paste HTML into the source box to render it.
- structure, text, tables, inline and embedded CSS, data: pictures
- scripts, form submits, popups, navigation
- images, stylesheets, fonts, nested pages, anything else from the network
Why nothing in here can run. The preview is an iframe with one permission, same-origin, and the document inside it carries
default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:. The first half of that is the frame: with no permission to run code, submit a form, open a window or navigate the page around it, the markup has nothing to act with. The second half is the policy: every file the markup asks for to draw itself, a stylesheet, an image, a font, a nested page, is refused, apart from a picture or a font written into the page itself as a data: URL, which is not a request at all. A link is the one thing a click can still act on. A link that names no target of its own is aimed at a new window the frame may not open, so it renders, reads and goes nowhere; a link the document explicitly aims at the frame, with target="_self", does load inside the preview, under the same sandbox, and that click is a real request. Nothing you paste is sent anywhere, and up to 200,000 characters of it is kept in this browser alone so it is still here when you come back. The Start over button above forgets it.Up to 1 MB of HTML at a time, which is 1,048,576 bytes of source. The preview rebuilds when you stop typing, so a long paste is rendered once rather than on every keystroke.
Accuracy. Your HTML renders in a sandboxed frame given one permission, same-origin, so no script runs, no form submits, no window opens and nothing navigates on its own; a link the document aims at the frame itself is the one thing a click still loads, inside the preview and still sandboxed. The policy in that document, default-src 'none', refuses every file the markup asks for apart from a picture or a font written in as a data: URL, so a page built from external scripts, stylesheets, images or fonts looks different here than in a browser. Your source stays in this tab, and the tool lists what your document asked for that was withheld.
Common questions
- Why do scripts not run in the preview?
- Two separate things stop them, and either one alone would be enough. The preview is an iframe whose sandbox grants exactly one permission, same-origin, so the frame is never given permission to execute code, submit a form, open a window or navigate the page. On top of that, the document the frame renders carries its own content policy, default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:, which refuses a script file and an inline script alike. That belt and braces matters because pasting HTML out of an email, a scraped page or a message from a stranger is exactly the case where a script would do something you never asked for. The cost is stated rather than hidden: a page that draws its content with JavaScript shows only the markup that existed before the script would have run, and the list under the preview tells you how many script tags it found.
- Why does an image from the web not appear?
- Because fetching it would be a network request, and the policy allows none. The only pictures that render are the ones written into the page itself as a data: URL, since those carry their own bytes and ask for nothing. An image tag pointing at a web address, at a relative path such as logo.png, or a CSS background image is left empty, and the list under the preview counts them so you can see the page is not broken, only unfed. The same rule covers a stylesheet in a separate file, a web font and a nested page: a document whose look lives in an external .css file renders with its structure intact and its styling missing, while the CSS written inside the document, in a style element or a style attribute, is applied normally.
- How much HTML can I paste?
- Up to 1 MB at a time, which is 1,048,576 bytes of source. That is a large page, and most single documents, inline styling included, come to a small fraction of it. The measure is bytes rather than characters, so ordinary English text costs one byte per character while an emoji costs four and Hebrew, Greek or Chinese text costs two or three; the pane heading shows the size of what you have pasted. Past the limit the tool says how large the document is and how large it may be, and renders nothing until you cut it down, rather than quietly truncating the page and showing you a preview that is missing its ending.
- Is my HTML uploaded anywhere?
- No. The rendering happens in your own browser, in a frame on this page, so there is no server in this, no account to make and nothing sent or logged. The tool makes no network request of its own, and the policy in the preview refuses every request the document asks for. The draft is remembered in this browser alone so it is still there when you come back: up to 200,000 characters of it is written to local storage, a document longer than that is still rendered in full but is not stored, and the Start over button above the tool forgets whatever was kept.
- Can I open an HTML file from my computer?
- Yes. Open file reads a file from this machine straight into the source box, and dropping an .html file onto the panel does the same thing. Your browser does the reading and the file is never uploaded. Download HTML writes the source box back out as an .html file, exactly as you typed or pasted it, so the round trip changes nothing. One thing to expect: a page saved from a browser usually keeps its images, stylesheets and fonts in a folder beside it, and those are separate files the preview will not load, so a saved page often renders here with its text and structure and none of its pictures.
- Why does the page look different here than in a browser?
- Because a browser gives a page everything this preview withholds. Anything a script would have drawn is absent, anything that had to be fetched is absent, and a form renders but cannot be submitted. One more difference is worth knowing: a link that names no target of its own is aimed at a new window the frame is not allowed to open, so it looks and reads as normal and clicking it does nothing at all, which is what you want for a page you have not decided to trust. The case that behaves differently is a link the document explicitly aims at the frame itself, with target="_self": your markup is never rewritten, so that target stands over the default and a frame is always allowed to replace its own contents, which means that one click does make a request. The sandbox goes with it, so nothing on the page that arrives can run a script, submit a form, open a window or reach the tab it loads in. The content policy does not go with it: it is a meta tag inside the preview document, so it covers the HTML you pasted and not a page fetched after it, which answers to its own server. What does render is everything else, which is most of a typical document: structure, text, headings, lists, tables, inline and embedded CSS, and pictures written into the page as data: URLs.
- What is the list under the preview telling me?
- It is a count of the things in the document you pasted that the preview will not give it, worked out from your own markup rather than printed as a standing warning. It names script tags, forms, nested pages, images that come from a file or a web address, stylesheets loaded from another file, and web fonts, with how many of each it found. When your document needs none of them the list says that instead, which is a useful answer in itself: nothing in that markup was reaching outside the page. Under it, the outline lists every heading in document order, indented by level, which is the quickest way to see the shape of a page somebody sent you and gives the same summary to a reader who is not looking at the frame.
- Does it change or clean up my HTML?
- No. The source goes between a fixed head and two closing tags and reaches the frame exactly as you pasted it: nothing is escaped, stripped, reformatted, sorted or repaired, and the download writes back what is in the box. That is deliberate. A viewer that quietly sanitised your markup would be showing you a page you do not actually have, which is the opposite of the job. The safety here comes from what the frame is allowed to do, not from editing what you pasted, so a broken tag or an unclosed div renders exactly as broken here as it would anywhere else, which is often the thing you opened the viewer to find.
Your HTML renders in a sandboxed frame given one permission, same-origin, so no script runs, no form submits, no window opens and nothing navigates on its own; a link the document aims at the frame itself is the one thing a click still loads, inside the preview and still sandboxed. The policy in that document, default-src 'none', refuses every file the markup asks for apart from a picture or a font written in as a data: URL, so a page built from external scripts, stylesheets, images or fonts looks different here than in a browser. Your source stays in this tab, and the tool lists what your document asked for that was withheld.