Render HTML snippets locally without leaving the browser or running scripts.
Start here Paste the HTML fragment into the left panel; the preview updates as you type.
The preview is sandboxed and scripts are disabled for safety.
Understand the format
A sandboxed preview shows how markup will be laid out, with scripts disabled, so untrusted snippets can be reviewed without executing anything.
The markup is placed in an iframe using the srcdoc attribute together with a fully restrictive sandbox attribute. With no allow tokens, the browser applies every restriction available: scripts do not run, forms cannot submit, the frame gets a unique opaque origin, and it cannot navigate the page that contains it. What you see is the rendered structure of the markup, nothing more.
That trade-off is deliberate. Anything driven by JavaScript will not appear, but any snippet, including one copied from a suspicious email or an untrusted CMS field, can be inspected safely.
The preview reliably answers questions about structure and inline styling: whether tags are balanced, whether a wrapper is missing, how a table or list renders, and whether inline CSS produces the intended layout. It is a fast way to review content fragments before they are pasted into a template.
It cannot answer questions about the surrounding application. Site stylesheets, custom fonts, external images, framework hydration, and script-driven behaviour are all absent. Confirm the final appearance in a real environment before shipping.
Step by step
Markup is rendered locally inside a sandboxed iframe. Nothing is uploaded, and the frame cannot read the surrounding page or submit data.
Worked examples
Input
<h2>Release notes</h2><ul><li>Fixed export</li><li>New filters</li></ul>
Result
A heading followed by a two-item bulleted list
Renders the semantic structure that assistive technology will announce, before the site stylesheet changes its appearance.
Input
<p>Hello</p><script>alert(1)</script>
Result
Only the paragraph is rendered
The sandbox blocks script execution, which is what makes it safe to preview markup from an untrusted source.
Reference
| Feature | Works here | Why |
|---|---|---|
| Semantic markup and text | Yes | Parsed and laid out by the browser as normal. |
| Inline style attributes | Yes | Applied directly to the elements. |
| Inline style blocks | Yes | CSS inside the document is honoured. |
| JavaScript | No | Blocked by the sandbox attribute. |
| Form submission | No | Blocked, so a snippet cannot post data anywhere. |
| External images and fonts | Depends | Remote requests may be blocked by the frame origin or by the network. |
Practical Guide
Troubleshooting
FAQ
Yes, within this page. The frame runs with a fully restrictive sandbox, so scripts do not execute and forms cannot submit. That is not a licence to publish the same markup on a live site.
By design. The sandbox attribute is applied with no allow-scripts token, which is what makes previewing untrusted markup safe.
Yes. A full document including head and body renders correctly, as do inline style blocks within it.
Remote assets may be blocked by the sandboxed frame origin or unavailable from your network. Use a data URI, or check in a real environment.
No. It is passed to the iframe srcdoc attribute in your browser and never sent to a server.
Go deeper
