HTML Runner

Live demo · Security model · Self-hosting

HTML Runner is a local-first HTML, CSS, and JavaScript playground for short, deliberate preview tasks. Paste a snippet or import an HTML file, inspect obvious external resources, then run it in a restricted iframe or use Strict Preview to disable JavaScript and external network access.

It is intentionally smaller than a cloud IDE: no account, backend, project hosting, package installation, or server-side execution.

What it provides

• CodeMirror editors for HTML, CSS, and JavaScript
• manual Run plus opt-in, 700 ms debounced Auto Run
• a sandboxed iframe without allow-same-origin, forms, popups, downloads, or top navigation
• Strict Preview with DOM-based policy injection, script removal, navigation neutralization, script-src 'none', and connect-src 'none'
• bridged Console logs, runtime errors, and unhandled promise rejections
• Fit, 1440 px, 768 px, and 375 px preview widths
• local HTML/HTM import and standalone HTML export
• static third-party resource scanning
• compressed, local-only URL Fragment sharing
• local draft persistence with in-memory fallback
• Light, Dark, and System themes

Does it upload code?

No. The editor, file reader, scanner, preview builder, draft storage, export, and share compression all run in the browser. This repository has no application backend, and analytics are disabled.

There is an important boundary: code run in Sandboxed Run can request allowed HTTPS resources. Those third parties may receive network and browser information. Strict Preview blocks external resources and all JavaScript. Neither mode is a malware-analysis environment; see the security model.

Run locally

Requirements: Node.js 24+ and pnpm 11+.

pnpm install
pnpm dev

Open the local URL printed by Vite. The configured production base path is /html-runner/ for GitHub Pages.

Verify a change

pnpm lint
pnpm type-check
pnpm test
pnpm exec playwright install
pnpm test:e2e
pnpm build

Pull requests must pass lint, type checking, unit/integration tests, the production build, and Playwright across Chromium, Firefox, WebKit, Android Chrome, and iPhone WebKit.

Self-host

The build output is static and contains no API routes or database. Run pnpm build, then serve dist/ from a secure origin. Read SELF_HOSTING.md before changing the base path, canonical URL, sitemap, or security headers.

Sandbox: what it does and does not do

The default iframe is created with:

<iframe sandbox="allow-scripts" referrerpolicy="no-referrer" allow=""></iframe>

Every run gets a new iframe, run ID, and nonce. The parent accepts Console messages only from the current iframe and matching identifiers. A mode-specific CSP is injected before user scripts.

The sandbox does not guarantee that hostile code is harmless. CPU-heavy or infinite JavaScript can freeze the tab, static scanning misses dynamic requests, and allowed external resources can communicate with third parties. Do not use this tool to analyze high-risk unknown code.

Contributing and security

Read CONTRIBUTING.md before opening a pull request. Report vulnerabilities privately through GitHub Security Advisories, not a public issue.

License

HTML Runner is available under the MIT License.