HTML Previewer
Paste HTML and see it rendered live in a safe, sandboxed preview.
Preview HTML safely in your browser
Paste any HTML and this tool renders it instantly in an <iframe sandbox> with all scripts disabled, so you can safely preview markup from an email, a CMS, or an untrusted source without any risk of it running code. Nothing is uploaded — the preview is generated entirely on your device.
Pasted something that shows up as escaped text — full of \uXXXX sequences or < entities? Turn on Decode escape sequences first to unescape it before rendering. To tidy the source itself, try the HTML formatter; to pull out just the words, use remove HTML tags; and to unescape a string on its own, the JSON escape / unescape tool does it in one click.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Seeing how a fragment renders without creating a file.
- Checking a snippet from documentation before using it.
- Testing a markup change without creating a file to open.
- Rendering an email fragment to see its layout.
- Previewing markup someone sent you before pasting it anywhere.
Frequently Asked Questions
- How is the preview isolated?
- In a sandboxed iframe, which prevents the previewed markup reaching the page around it. That is essential rather than optional — rendering arbitrary HTML in the same document would let a pasted `<script>` read and modify everything on the page.
- Why do external resources not load?
- The sandbox restricts what the frame may do, and a strict Content-Security-Policy blocks third-party requests. So a preview referencing a CDN stylesheet renders unstyled — which is a limitation of doing this safely rather than something to work around.
- Does the preview match a real browser?
- For layout and styling, yes — it is the same engine. What differs is context: no page-level CSS, no fonts you have not inlined, and restricted scripting. It shows how the markup renders, not how it will behave inside your application.
- Is it safe to paste untrusted HTML?
- Safer than any alternative in a browser, because the sandbox denies same-origin access and script execution unless explicitly allowed. It is still worth remembering that rendering untrusted markup anywhere is a decision, not a neutral act.
- Why does my document render differently to how I wrote it?
- Browsers apply a specified error-recovery algorithm to invalid markup — an unclosed element can swallow everything after it, and a table row outside a table is relocated. The preview shows the corrected DOM, which is exactly what makes it useful for debugging.
Common errors and gotchas
- Assuming the sandbox render matches a real page, where the surrounding CSS is absent.
- Expecting external stylesheets and scripts to load, which a sandbox usually blocks.
- Pasting untrusted markup and treating the sandbox as complete protection.
- Testing an email fragment here, where client rendering differs enormously.
- Judging responsive behaviour in a small preview frame.