Paste or upload HTML and see it rendered straight away. Add CSS and JavaScript in their own panes, watch console messages and errors underneath, switch between phone, tablet and desktop widths, and share the result as a link or download it as one .html file. Your code runs in a locked-down frame that cannot reach this page, your cookies or your other tabs.
Running code from a stranger's link is only safe if it cannot touch anything else. The preview here is an iframe whose content is passed in with srcdoc and whose sandbox attribute allows scripts and nothing more. Leaving out allow-same-origin is the important part: the browser gives the frame a fresh opaque origin, so it is treated like a different website with no cookies, no storage and no access to the we.inc page around it. Leaving out allow-popups, allow-forms, allow-modals and allow-top-navigation means it cannot open windows, send forms, show dialogs or redirect you.
The console works without weakening any of that. A small script added at the top of the preview wraps console.log and the other console methods, turns each value into plain text inside the frame, and posts that text out with postMessage. The viewer only accepts messages that come from the current preview frame and carry the ID of the current run, and shows them as text, never as HTML. Nothing ever flows the other way: the editor never runs your code itself, and never sends anything into the frame except the document you wrote.
If someone sent you an .html file, an email template or a page saved from a browser, use Upload or drop it on the editor. The viewer moves inline <style> blocks into the CSS pane and plain inline <script> blocks into the JavaScript pane, so you can read each part on its own. Scripts loaded from a URL, modules and JSON data blocks stay where they are in the HTML. Relative links to images or stylesheets that sat next to the file on someone's computer will not load, because the viewer only has the one file; swap them for full URLs to see them.
Email templates are worth checking at 375 pixels as well as full width, since most email is read on phones. Remember that email apps support far less CSS than browsers, so a preview here shows how the HTML renders in a browser, not in every inbox.
A single HTML file is a fine way to try a layout, test a snippet from a tutorial or show a client an idea. When the idea needs several pages, a contact form that really sends, a domain and someone who can edit text without touching code, it is time to move to a site builder or a proper project. Download keeps a portable copy of your work at any point. The We.Inc box below turns a description of your page into a brief you can take into the We.Inc builder and review there first.
The preview is an iframe with sandbox="allow-scripts" and nothing else. Scripts can run, but the frame gets a unique, empty origin, so it cannot read this page, our cookies or storage, cannot open pop-ups or new tabs, cannot submit forms, and cannot move the main window to another site. Shared links never run on their own: you see the code first and press Run. The frame can still load images, fonts and scripts from the internet, so only run code you would be happy to open in any browser tab.
It is free with no signup. Your code stays in your browser. Nothing is sent to We.Inc: drafts are kept in this browser's local storage, and share links keep the code after the # in the address, which browsers do not send to servers.
Because the frame has no origin of its own, the browser refuses storage and cookies there with a SecurityError. That is the sandbox doing its job. To test code that uses storage, download the .html file and open it from your computer or a local server.
You can load any library that ships a browser build from a CDN with a <script> tag in the HTML pane, and <script type="module"> with full CDN URLs works too. There is no build step, so JSX, TypeScript and bare imports such as import React from "react" will not run as written.
An endless loop in your JavaScript can block the page, because some browsers run a sandboxed frame in the same process as the page around it. Reload, turn off auto-run before your code finishes loading from the saved draft, fix the loop and press Run.
It re-indents the pane you are working in: HTML elements on their own lines with inline text kept together, CSS rules one declaration per line, and JavaScript with consistent braces and spacing. It does not change what the code does, and it does not check it for mistakes.
Related: HTML formatter, HTML validator, HTML minifier, CSS formatter, JavaScript formatter.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.