Share HTML as source, not as a live page
If you paste HTML into a chat window, the client might render it — or strip the tags that matter and leave you debugging something that no longer exists. If you host it as a page, you have published it. A paste sits in between: the markup is shown as text, escaped, with nothing executed.
Why "never rendered" matters
The paste view escapes the content before it reaches the page. That means a <script> tag in your paste appears as characters, not as a script; an <img onerror=…> stays text; a form cannot submit. The same is true for the raw endpoint, which serves text/plain.
This is also why pastes are a reasonable way to share suspicious markup. If someone sends you an HTML payload and asks what it does, you can read it without loading it.
Before you share a page
- Strip analytics and tracking pixels. They leak the reader's IP and referrer to a third party when the paste is rendered somewhere else.
- Remove session-bound values. CSRF tokens, nonces tied to a session, signed asset URLs.
- Check for embedded credentials. Inline API keys, basic-auth URLs, admin-only endpoints.
- Replace absolute internal URLs.
https://admin.internal/…tells an attacker where to look. - Keep the doctype and the head. Half the bugs in "it renders differently" live in a missing meta charset or viewport tag.
Email HTML is its own format
If you are debugging an email template, paste the final rendered HTML rather than the template source — most email bugs come from what the templating engine produced, not from what you wrote. Also keep the plain-text alternative nearby; the mismatch between the two is a common reason a message gets flagged as spam.
Trim an email template before pasting
# strip comments and collapse blank lines for a smaller paste
perl -0pe 's/<!--.*?-->//gs' mail.html | grep -v '^$' > mail.min.htmlSettings that fit markup
Choose HTML as the language for tag and attribute colouring. Use unlisted — markup is rarely something you want in a public feed — and set an expiry if the page is from a work-in-progress branch. For a large document, a password plus a separate message is a cheap extra layer.
diff -u with the Diff language, or use the browser-only text comparison tool.
Create an HTML paste
Frequently asked questions
Will my HTML render on the paste page?
No. The source is escaped and displayed as text. Scripts, styles, forms and images are not executed or loaded.
Is it safe to open an HTML paste someone sent me?
Opening the paste page is safe because nothing is rendered. Copying the markup into your own project is where the risk starts — read it first.
Can I preview the HTML somewhere?
Not on pastesite.com. Use a local file or a sandboxed preview tool. Keeping preview and sharing separate is deliberate.
Does the raw endpoint serve text/html?
No, it serves text/plain; charset=utf-8, so a browser shows the source rather than executing it.