JavaScript Sandbox

Run HTML, CSS and JavaScript safely in your browser.

Editor

Auto-run

HTML

<!-- your HTML goes here -->
<h1>Hello, sandbox!</h1>
<button id="btn">Click me</button>

Preview

Console

How the sandbox keeps you safe

Code runs in an opaque-origin iframe — it cannot read cookies, localStorage or sessionStorage.
The iframe has no allow-same-origin, allow-forms, allow-popups or allow-top-navigation, so it cannot navigate the page or open popups.
It can only talk back through a postMessage channel that feeds the console panel below.
Your code never leaves your browser — there is no server involved at any point.

Frequently asked questions

Is it safe to run untrusted code here?

Yes. Code runs inside an iframe with the sandbox attribute enabled: scripts are allowed, but the frame has an opaque origin. It cannot touch cookies, localStorage, sessionStorage, the parent DOM, or navigate the page.

Why is my alert() or prompt() blocked?

Sandboxed iframes disable modal dialogs. Use console.log to inspect values instead — the console panel in this tool shows the output.

Can I load external scripts?

Yes, if the iframe is allowed to fetch them and the host sends permissive CORS headers. For privacy and safety, most third-party CDNs are blocked by the sandbox — keep scripts local.