jQuery.parseHTML(data [, context ] [, keepScripts ]) (alias $.parseHTML) turns an HTML string into an array of DOM nodes using native browser parsing (added in jQuery 1.8). Nodes stay detached until you append them.
Remember
$.parseHTML(htmlString) → Array of DOM nodes
nodes = $.parseHTML("<p>Hi</p><span>Go</span>")
// → [ <p>, <span> ]
$("#box").append(nodes) // now visible on the page
Parse offline, inspect the node array, then append only what you trust.
Start with an HTML string (fragment, template, or plain text).
Optionally .trim() the string to drop edge whitespace text nodes.
Call $.parseHTML(html) to get a plain array of nodes.
Inspect or filter nodes, then $(target).append(nodes) when ready.
Piece
Required?
Role
data
Yes
HTML string to parse
context
No
Document used as parse context (detached doc in 3.0+ if omitted)
keepScripts
No
Include <script> nodes when true (default false)
Return
—
Array of DOM nodes (not a jQuery object)
Pseudocode
Pseudocode
function parseHTML(data, context, keepScripts):
// native HTML fragment parse
nodes = parse data into DOM nodes
if keepScripts is false:
remove script elements from nodes
return nodes // plain Array
// Typical jQuery flow:
html = markup.trim()
nodes = $.parseHTML(html)
$("#mount").append(nodes)
Reference
Cheat Sheet
Keep these facts handy while parsing HTML with jQuery.
Pick a sample string, parse it with $.parseHTML, and inspect the node list.
Browser demo of $.parseHTML() — same ideas as the examples below.
Result
sample = Plain text
nodes → 1
names → #text
Code
jQuery Examples
Short, copy-ready snippets. Open DevTools Console, or use Try It Yourself for a live editor.
Example 1 — Official Demo (Plain Text)
Official jQuery API pattern: even plain text becomes a node.
jQuery
var str = "hello, my name is jQuery.";
var html = $.parseHTML(str);
var names = [];
$.each(html, function (i, el) {
names.push(el.nodeName);
});
console.log(html.length); // 1
console.log(names.join(", ")); // "#text"
Build safely. Split the word script so demos do not confuse HTML parsers.
Default.$.parseHTML(snippet) drops the script — only P remains.
keepScripts true. The script element is kept in the array (still use only trusted markup).
Security. Leaving scripts out is safer, but attributes can still be dangerous after append — sanitize untrusted HTML.
Edge Cases & Pitfalls
Check these before parsing real templates or API HTML.
security
Not a sanitizer
Scripts may be stripped by default, but event-handler attributes and other vectors can still run after you insert nodes. Never treat parseHTML as XSS protection.
whitespace
Edge spaces become text nodes
Trim the string (or use $.trim) when you only want element nodes at the edges.
return type
Array, not a jQuery object
$.parseHTML returns a native array. Use $(nodes) if you need .find() or other collection methods.
XML
Use parseXML for XML
HTML fragments belong here. Well-formed XML feeds belong to $.parseXML().
Compatibility
Browser Support
jQuery.parseHTML() needs a browser DOM (native HTML parsing). It is available since jQuery 1.8+ in all modern browsers — it is not supported in Node.js, Bun, or Deno without a DOM polyfill.
✓ jQuery 1.8+ · Browsers only
jQuery.parseHTML()
Works in Chrome, Firefox, Safari, Edge, and other browsers with jQuery loaded. No Node.js support — use a DOM environment or a server HTML library there.
100%Browser support
Google ChromeAll versions · Desktop & Mobile
Full support
Mozilla FirefoxAll versions · Desktop & Mobile
Full support
Apple SafariAll versions · macOS & iOS
Full support
Microsoft EdgeAll versions · Chromium & Legacy
Full support
Internet ExplorerIE 6+ · Legacy environments
Full support
OperaAll modern versions
Full support
$.parseHTML()Browsers
Bottom line: Use $.parseHTML(str) in the browser only. For Node.js, parse HTML with a server-side library instead of jQuery.
Analysis
Performance Notes
Approach
Cost
Best for
$.parseHTML(str)
O(n) in string size
Small/medium HTML fragments
Parse once, reuse nodes
Cheapest
Templates you mount more than once (clone if needed)
Re-parse the same string
Wasteful
Avoid in hot loops — cache the node array
Parsing dominates cost on large markup. Parse once, keep the node array (or a clone), and append without re-parsing the same string.
Remember
Key Takeaways
Role:$.parseHTML(str) → array of DOM nodes.
Scripts: off by default; set keepScripts only for trusted markup.
Trim: edge whitespace becomes #text nodes unless you trim first.
Security: sanitize untrusted HTML before append — parseHTML is not a filter.
One line: parse HTML into a node array with $.parseHTML, trim when needed, keep scripts off for untrusted input, then append only what you trust.
Frequently Asked Questions
jQuery.parseHTML(data, context, keepScripts) parses an HTML string and returns an array of DOM nodes — elements, text nodes, and comments — without inserting them into the page. Append the array with .append() or inspect nodes first.
The jQuery API passes a plain text string to $.parseHTML(), appends the resulting nodes to a log div, and lists each node name (such as #text). Even a string without tags becomes a text node in the returned array.
parseHTML returns a plain array of nodes and does not run scripts by default (keepScripts is false). $(html) builds a jQuery collection and inserting that HTML into the live document can still run malicious code. Use parseHTML when you want nodes first, then decide what to inject.
When keepScripts is false (the default), script elements in the HTML string are omitted from the returned nodes. When true, script tags are included in the array. Never pass untrusted HTML with keepScripts true.
Leading and trailing whitespace in the HTML string can become text nodes. The jQuery API recommends jQuery.trim() (or String.prototype.trim()) first when you want to avoid extra edge whitespace nodes.
When context is omitted, null, or undefined, jQuery 3.0+ uses a new detached document to parse HTML. That helps prevent inline event handlers from firing during parsing. Once you inject the nodes into the live page, handlers can still run — always sanitize untrusted input.
No. It is not a security filter. Indirect script execution (for example via event-handler attributes) is still possible. Clean or escape untrusted input from URLs, cookies, or forms before parsing and inserting.