JavaScript Document.parseHTML() Method

Beginner
5 min read
Updated: Nov 2026
3 examples
Method
Decorative image with the word PARSEHTML

Definition

Document.parseHTML(input) is a static method that parses an HTML string, sanitizes it (XSS-safe), and returns a new Document (MDN). Prefer it over parseHTMLUnsafe() unless you must allow unsafe markup.

Pass the required arguments shown below. Check return values and browser support before you rely on the result.

Syntax

Call Document.parseHTML. Start with this line.

JavaScript
Document.parseHTML(input, options?)
CallWhat it does
Document.parseHTML(input, options?)Primary signature.
Document.parseHTML(...)Call with the arguments your case needs.

Built into the browser. Call Document.parseHTML(...) on the Document constructor — no import required.

Library declarations
JavaScript
Document.parseHTML(input, options?)

Parameters

ParameterDescription
inputRequired. HTML string to parse and sanitize
options.sanitizerOptional. Sanitizer, SanitizerConfig, or "default"

Return Value

Return ValueDescription
*New XSS-safe Document

JavaScript Examples

Example 1 — Parse HTML and Strip Scripts

Default sanitizer removes XSS-unsafe markup such as <script>.

JavaScript
if (typeof Document.parseHTML !== "function") {
  console.log("unsupported");
} else {
  const html = "
Hello
alert(1)";
  const doc = Document.parseHTML(html);
  console.log(doc.body.innerHTML);
  // "
Hello
"  (script removed)
}
Try It Yourself

How It Works

  1. Detect the static method. Call Document.parseHTML, not document.parseHTML.
  2. Pass markup with a script. Untrusted HTML often includes dangerous tags.
  3. Sanitize during parse. MDN: XSS-unsafe elements are removed.
  4. Read body.innerHTML. Safe content remains; the script does not.

Example 2 — New Document Metadata

MDN: the result is text/html, UTF-8, URL about:blank.

JavaScript
if (typeof Document.parseHTML !== "function") {
  console.log("unsupported");
} else {
  const doc = Document.parseHTML("
Hi
");
  console.log(doc.contentType);   // "text/html"
  console.log(doc.characterSet);  // "UTF-8"
  console.log(doc.URL);           // "about:blank"
}
Try It Yourself

How It Works

  1. Parse a tiny document. You get a full Document, not a fragment.
  2. Check contentType. Always text/html for this API (MDN).
  3. Check charset and URL. UTF-8 and about:blank by design (MDN).
  4. Use nodes next. Import or adopt into the live page when needed.

Example 3 — Feature-Detect with DOMParser Fallback

When parseHTML is missing, parse with DOMParser (and sanitize separately in real apps).

JavaScript
function parseHtmlSafe(html) {
  if (typeof Document.parseHTML === "function") {
    return { via: "parseHTML", doc: Document.parseHTML(html) };
  }
  const doc = new DOMParser().parseFromString(html, "text/html");
  return { via: "DOMParser", doc: doc };
}

const result = parseHtmlSafe("
Hello
");
console.log(result.via);
console.log(result.doc.body.textContent);
Try It Yourself

How It Works

  1. Prefer parseHTML. Built-in XSS sanitization (MDN).
  2. Fall back to DOMParser. Baseline parsing without that sanitizer.
  3. Return which path ran. Helps demos and debugging.
  4. Production note. On the DOMParser path, add a real sanitizer (library or server).
Compatibility

Browser Support

Document.parseHTML() is Limited availability on MDN (not Baseline). Support includes Chrome/Edge 146+ and Firefox 148+; Safari currently lacks support. See the MDN parseHTML() reference.

✓ Limited availability

Document.parseHTML()

XSS-safe static HTML → Document. Feature-detect and provide a sanitizing fallback.

Limited Not Baseline
Google Chrome 146+
Yes
Microsoft Edge 146+
Yes
Mozilla Firefox 148+
Yes
Opera Follow Chromium
Partial
Apple Safari Not supported
No
Internet Explorer Not supported
No
parseHTML() Partial

Bottom line: Use parseHTML when available. Elsewhere, DOMParser plus a sanitizer library (or server-side sanitization) is the practical fallback.

Frequently Asked Questions

It is a static method that parses and sanitizes an HTML string and returns a new Document instance that is XSS-safe (MDN).
No. MDN marks Document.parseHTML() as Limited availability (not Baseline). It is not Deprecated, Experimental, or Non-standard; it is defined in the HTML specification.
MDN: content type "text/html", character set UTF-8, and URL "about:blank".
MDN: only when you specifically need to allow unsafe elements and attributes. Prefer Document.parseHTML() for untrusted HTML.
DOMParser.parseFromString() parses HTML or XML without the built-in XSS sanitizer that parseHTML() applies. parseHTML() always removes XSS-unsafe entities (MDN).
MDN: because this method always sanitizes XSS-unsafe entities, it is not secured or validated using the Trusted Types API.

Next: parseHTMLUnsafe()

Learn the unsanitized twin API and when MDN says you might need it.

parseHTMLUnsafe() tutorial →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

14 people found this page helpful

JavaScript Document prepend() Method JavaScript Document parseHTMLUnsafe() Method