HTML Viewer & Live Editor

Your code is placed in an through its srcdoc attribute, so the browser renders it as a separate document without saving a file or contacting a server. The preview refreshes 300 ms after you stop typing, which avoids reloading scripts on every keystroke; Refresh preview forces an immediate reload.

You can paste a complete page starting with or just a fragment such as a table or a form. Fragments are wrapped in a minimal document with and a responsive viewport tag, so accented characters display correctly and the Phone 375 width behaves like a real phone instead of a zoomed-out desktop page.

The counter under the editor shows lines, characters, UTF-8 bytes and opening tags. Bytes matter when HTML is embedded in email (many clients clip messages over about 102 KB) or stored in a size-limited database column.

HTML you paste from elsewhere can contain scripts. The preview frame uses the sandbox attribute with only allow-scripts and allow-modals. It deliberately omits allow-same-origin, so the previewed page runs in a unique opaque origin:

• It cannot read this site's cookies, localStorage or the editor contents.
• It cannot submit forms, open pop-ups or navigate the top window.
• It cannot escape the sandbox. MDN warns that combining allow-scripts with allow-same-origin lets an embedded page remove its own sandbox attribute, which is why that pair is never used here.

Turning off Run JavaScript sets an empty sandbox, the most restrictive mode, which is useful for inspecting an email template or a suspicious snippet without executing anything.