HTML Viewer: Open and Preview HTML Files Online

Q: Do the scripts have access to my accounts when I turn on "Run scripts"?

No. The frame has no `allow-same-origin`, so the code cannot read this site's cookies or storage, and its network requests are blocked. Scripts can still change what the page shows, so keep the switch off for files you do not trust.

How to use it

Open a file or paste code. Drop an .html, .htm, .xhtml or .svg file on the page, pick one from your device, or paste HTML into the text area. Files can be up to 5 MB.
Look at the preview. The page is shown in a sandboxed frame. Choose phone, tablet or full width to see how it behaves at different widths.
Check the Info panel. See size, lines, title, document type, charset, language, how many scripts, stylesheets, images, links and forms the file has, and which external domains it would contact.
Turn on switches only if needed. If the page looks unstyled or empty, try "Load external resources" or "Run scripts". Both stay inside the sandbox, but leave them off for files you do not trust.

How the preview works

An HTML file is just text that a browser turns into a page. Double-clicking it opens it in your browser with full powers: it can run scripts and load anything from the internet. This viewer opens the same code in a restricted frame instead, so you can look at it first.

Sandboxed frame. The preview is an iframe with the sandbox attribute and without allow-same-origin. The file is treated as coming from an unknown origin and cannot read this site's data or cookies.
Content-Security-Policy. By default a policy is inserted at the top of the document. It blocks scripts and anything that would be fetched from other sites: images, fonts and stylesheets from the internet are not loaded. Images embedded as data: and inline CSS in <style> work normally.
No upload. The file is read in your browser with the File API. It is not sent to any server, and with the default settings opening it makes no third-party requests.
Forms and navigation. Forms cannot be submitted from the preview, and network requests from scripts (fetch, XHR) stay blocked even when scripts are on.

Because external resources are blocked, a saved web page may look plainer here than in a normal browser. That is expected and is also useful: it shows what the file contains by itself.

The Info panel is computed from the source text with pattern matching, not with a full HTML parser. Treat the counts as a quick summary: comments and the content of script and style blocks are ignored when counting tags.

The two switches and what they change

Two switches control what the previewed page may do. Both are off by default. Whatever you choose, the frame stays sandboxed and never gets access to this site.

Load external resources	Run scripts	What happens
Off	Off	Default and safest. Only the HTML, inline CSS and `data:` images are shown. No script runs and nothing is requested from other sites.
On	Off	Images, fonts and stylesheets from the internet are loaded, so the page looks like the original. Your browser contacts those servers, which can see your IP address. No script runs.
Off	On	Inline scripts run, but they cannot load anything from the internet. Useful for a self-contained report with charts drawn by its own code.
On	On	Scripts run and can load more scripts and resources. This is the closest to a normal browser. Use it only for files you trust.

Even with scripts on, requests made by scripts (fetch, XHR) stay blocked and forms cannot be submitted. Loading external resources, however, does make real requests to other servers.

What it is useful for

A newsletter with tracking pixels

You saved a newsletter as an .html file and want to know whether it tracks you. Open it with both switches off: the text and layout appear, the remote images do not. In the Info panel you might see a list of external domains, including a host that serves a 1×1 image. That is the typical tracking pixel: when an email client loads it, the sender learns that the message was opened. You decide whether to keep loading images from that sender.

An unknown HTML attachment

An email brings an invoice.html you did not expect. Phishing attachments are often HTML files that show a fake login page. Opening the file here with scripts off lets you read it without running anything. The Info panel shows whether it has a form and which domains it points to. If it asks for a password, close it: never type credentials into a page that comes from an attachment.

A report exported from software

Many programs export reports, test results or documentation as a single .html file. Open it with scripts off to check the content; if tables or charts are missing, turn on "Run scripts" and look again. The phone and tablet widths show how it reads on a smaller screen.

Checking an SVG

An .svg file is an image written as text. Open it to see how it renders, then read the source to check the size, the title and whether it contains scripts or links to other sites.

Trying a snippet

Paste a fragment such as a heading with some inline CSS and see the result straight away, without creating a file. The Info panel recognises it as a fragment rather than a full page.

How safe is it, and what it does not do

Viewing a suspicious file here with the default settings is safer than double-clicking it, because nothing runs and nothing is fetched. The browser's sandbox and the Content-Security-Policy are the protections involved, and they are the same mechanisms browsers use for any embedded frame.

It is still a viewer, not a security product.

It is not an antivirus. It does not scan for malware, does not recognise known threats and gives no verdict of safe or unsafe.
A page can still deceive you. A fake login form looks real even when it cannot send data. Never enter passwords, card numbers or codes into a page you opened from an attachment.
Links. Do not click links in an untrusted preview. If a page tells you to download or install something, do not.
The switches change the risk. Loading external resources contacts third-party servers; running scripts executes the file's code in the sandbox.
Counts are approximate. The Info panel summarises the text of the file and can miss things that are built by scripts at run time.

For files you really cannot trust, the safest choice is not to open them at all, or to ask the sender through another channel. Keep your system and browser updated.

Reading the Info panel

The panel is a checklist you can read in a few seconds. It shows the size in bytes and the number of lines, then:

Title, document type, doctype. The document is a full HTML page, an SVG, or a fragment. A page without a doctype may be rendered in quirks mode by browsers.
Charset and language. If the file has no declared charset, accented letters may appear garbled. The lang attribute helps screen readers and translation.
Elements. The number of tags found in the markup.
Scripts and stylesheets. Inline and external counts. External scripts are the usual way a page pulls in code from other sites.
Images, links, forms, iframes. Quick signals: a form on a page you did not expect, or an iframe pointing elsewhere, deserves attention.
External domains. The hosts mentioned in src, href, srcset, url(...) and @import. A short list of well-known domains is normal for a saved web page; many unfamiliar ones are worth a closer look.

To work with the dates or times inside a report you exported, see the date calculator.

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read in your browser with the File API and shown in a frame on your device. It is not sent to a server.

Why does the page look different from the original?

By default scripts and resources from the internet are blocked, so external images, fonts and stylesheets do not load and script-built content is missing. Turn on "Load external resources" or "Run scripts" to get closer to the original, if you trust the file.

Is it safe to open a suspicious HTML attachment here?

It is safer than double-clicking it, because with the default settings no script runs and nothing is requested from other sites. But this is not an antivirus and gives no verdict. Never enter passwords or other credentials into such a page.

How can I see which servers a page contacts?

Open the file and read "External domains" in the Info panel. It lists the hosts found in links, images, scripts, stylesheets and CSS. A tracking pixel in a newsletter typically shows up as an unfamiliar domain.

What is the maximum file size?

5 MB. For larger files, paste only the part you need, or reduce the file first.

Which file types can I open?

Files ending in .html, .htm, .xhtml and .svg, and any HTML you paste as text. Other formats, such as .mht or .pdf, are not supported.

Do the scripts have access to my accounts when I turn on "Run scripts"?

No. The frame has no allow-same-origin, so the code cannot read this site's cookies or storage, and its network requests are blocked. Scripts can still change what the page shows, so keep the switch off for files you do not trust.

Last updated Wednesday, October 14, 2026