Skip to content
AgileLogics

HTML Viewer

Renders pasted HTML visually in a fully sandboxed iframe — scripts, forms, and same-origin access are all disabled, so pasted markup is shown safely without ever executing.

Working on a whole file? Open it in the HTML editor →

How it works

Paste HTML into the input panel and click View.

How can I view HTML code as a rendered page?

Paste the markup into this viewer and click View. The HTML is written into a sandboxed frame below the output box, and your browser renders it exactly as it would render a page: headings, tables, inline styles and <style> blocks all apply. Scripts never run, so it's a safe way to see what unfamiliar HTML looks like without opening it as a file.

Using the viewer

  1. Paste a full document or just a fragment, such as a <table> or an email signature, into the input box.
  2. Click View.
  3. The rendered result appears in a 256-pixel-tall preview frame. Scroll inside it to see more.
  4. The output box holds your HTML unchanged, so Copy gives you the same markup back.

Fragments are fine. Browsers wrap stray content in the <html>, <head> and <body> elements automatically, following the HTML parsing rules, so <p>Hi</p> on its own renders as a normal paragraph.

What the sandbox blocks

The preview is an <iframe> with sandbox="", the most restrictive setting there is. Each permission a sandbox can grant is turned on by a keyword, and an empty value grants none of them. The MDN iframe reference lists every keyword; these are the ones that matter for pasted HTML:

Missing permission Effect in the preview
allow-scripts <script> tags, onload/onclick attributes and javascript: URLs do nothing
allow-same-origin The content is treated as a unique origin, so it can't read this site's cookies or storage
allow-forms Forms display but can't be submitted
allow-popups Links with target="_blank" and window.open() can't open new windows
allow-top-navigation Nothing inside can redirect the main page
allow-modals No alert, confirm or print dialogs

Plugins via <embed> and <object> are blocked as well. The content still renders as normal, so CSS layout, fonts, colors, flexbox and grid all show correctly.

What still happens: remote resources

A sandbox stops code, not network requests. If the HTML contains <img src="https://..."> or a <link rel="stylesheet" href="https://...">, your browser fetches those files when the preview renders. Usually that's what you want. With HTML from a marketing email it's worth knowing that tracking pixels are just tiny remote images, so previewing the raw source here can register an "open" just as your mail client would. Delete remote <img> tags first if you'd rather not.

Paths, images and styles

The HTML is loaded through the frame's srcdoc attribute, and per the HTML standard such a document takes this page's address as its base URL. So a relative path like css/site.css or ../img/logo.png points at this website, where your files don't exist, and shows up broken. Some options:

  • Use absolute URLs (https://yoursite.example/img/logo.png).
  • Put CSS in a <style> block or in style attributes.
  • Embed small images as data URLs, which you can create with Image to Base64.

Example: checking an email signature

Paste this:

<table style="font-family: Arial, sans-serif; font-size: 14px">
  <tr>
    <td style="padding-right: 12px; border-right: 2px solid #2563eb">
      <strong>Sam Patel</strong><br>Head of Support
    </td>
    <td style="padding-left: 12px">
      +44 20 7946 0958<br>
      <a href="https://example.com">example.com</a>
    </td>
  </tr>
</table>

Click View and the signature renders as two columns divided by a blue line, as a mail client would show it. Table layout with inline styles is the usual approach for email because many mail clients ignore <style> blocks, so a viewer that applies inline styles faithfully is a quick first check. The real client may still differ.

When to use something else

You want to Use
Edit HTML with syntax highlighting The HTML editor
Show markup as visible text on a page The HTML encoder/decoder, which escapes < and >
Shrink HTML before deploying The HTML minifier
See interactive JavaScript behaviour Save it as a .html file and open it locally, only if you trust it

If you're learning the language itself, the HTML lessons start from the basic document structure this viewer fills in for you.

Last updated

Frequently asked questions

Is it safe to paste HTML from an untrusted source?
The preview frame uses an empty sandbox attribute, which disables scripts, form submission, pop-ups, plugins and same-origin access, so nothing in the markup can run code. One caveat: images and stylesheets referenced by full URLs still load, which tells those servers your IP address. Remove remote image tags first if that matters, for example with a suspicious email.
Why doesn't my JavaScript run?
On purpose. The frame is sandboxed without allow-scripts, so script tags, onclick and other event attributes, and javascript: links are all ignored. The viewer shows what the markup and CSS look like, not how the page behaves.
Why are my images broken?
Relative paths like images/logo.png are resolved against this website's address, where your files don't exist. Use absolute https:// URLs for images and stylesheets, or embed small images as Base64 data URLs.
Is my HTML uploaded?
No. The HTML is placed into the preview frame by your browser. It isn't sent to our server.