JavaScript Document.parseHTMLUnsafe() Method

Beginner
5 min read
Updated: Nov 2026
3 examples
Method
Decorative image with the word PARSEHTMLUNSAFE

Definition

Document.parseHTMLUnsafe(input) is a static method that parses HTML into a new Document. By default it does not sanitize — every entity in the input can be injected (MDN). Optional options.sanitizer can filter content.

Pass the required arguments shown below. Check return values and browser support before you rely on the result.

Syntax

Call Document.parseHTMLUnsafe. Start with this line.

JavaScript
Document.parseHTMLUnsafe(input, options?)
CallWhat it does
Document.parseHTMLUnsafe(input, options?)Primary signature.
Document.parseHTMLUnsafe(...)Call with the arguments your case needs.

Built into the browser. Call Document.parseHTMLUnsafe(...) on the Document constructor — no import required.

Library declarations
JavaScript
Document.parseHTMLUnsafe(input, options?)

Parameters

ParameterDescription
inputRequired. HTML string or TrustedHTML
options.sanitizerOptional. Sanitizer, config, or "default"; omit = no filter

Return Value

Return ValueDescription
*New Document

JavaScript Examples

Example 1 — Parse Trusted HTML

Create a new Document from a small trusted string.

JavaScript
if (typeof Document.parseHTMLUnsafe !== "function") {
  console.log("unsupported");
} else {
  const doc = Document.parseHTMLUnsafe("
Hello
");
  console.log(doc.body.textContent); // "Hello"
  console.log(doc.contentType);      // "text/html"
}
Try It Yourself

How It Works

  1. Detect the static method. Call Document.parseHTMLUnsafe, not on an instance.
  2. Pass trusted markup only. This demo string is hard-coded, not user input.
  3. Read the new Document. body.textContent shows the paragraph text.
  4. Check contentType. MDN: result is text/html.

Example 2 — Script Nodes Are Not Stripped by Default

Literacy check: without a sanitizer, a <script> element remains in the Document.

JavaScript
if (typeof Document.parseHTMLUnsafe !== "function") {
  console.log("unsupported");
} else {
  const html = "
Hi
/* demo */";
  const doc = Document.parseHTMLUnsafe(html);
  console.log(!!doc.querySelector("script")); // true
  // Do not eval or append this into a live page from untrusted input
}
Try It Yourself

How It Works

  1. Build a string with a script tag. Concatenation avoids breaking the host page.
  2. Parse with Unsafe. MDN: no sanitizer → entities are injected.
  3. Query for script. The node exists in the parsed Document.
  4. Security lesson. That is why MDN prefers parseHTML() for untrusted HTML.

Example 3 — Prefer parseHTML() When Available

MDN: almost always use the safe static method for untrusted markup.

JavaScript
function parseHtml(html, trusted) {
  if (!trusted && typeof Document.parseHTML === "function") {
    return { via: "parseHTML", doc: Document.parseHTML(html) };
  }
  if (typeof Document.parseHTMLUnsafe === "function") {
    return { via: "parseHTMLUnsafe", doc: Document.parseHTMLUnsafe(html) };
  }
  return { via: "unsupported", doc: null };
}

const result = parseHtml("
Hello
", false);
console.log(result.via);
console.log(result.doc && result.doc.body.textContent);
Try It Yourself

How It Works

  1. Branch on trust. Untrusted → try parseHTML first (MDN).
  2. Fall back to Unsafe. Only when the safe API is missing or input is trusted.
  3. Return which path ran. Makes demos and debugging clear.
  4. Production tip. Pair Unsafe with TrustedHTML or an explicit sanitizer when you must use it.
Compatibility

Browser Support

Document.parseHTMLUnsafe() is Baseline Newly available on MDN (across latest browsers since September 2025). Feature-detect on older engines. See the MDN parseHTMLUnsafe() reference.

✓ Baseline Newly available · 2025

Document.parseHTMLUnsafe()

Parse HTML into a Document without required sanitization. Prefer parseHTML() for untrusted content.

Baseline Newly available 2025
Google Chrome 124+
Yes
Microsoft Edge 124+
Yes
Mozilla Firefox 128+
Yes
Apple Safari 26+
Yes
Opera 110+
Yes
Internet Explorer Not supported
No
parseHTMLUnsafe() Modern browsers

Bottom line: Chrome/Edge 124+, Firefox 128+, Safari 26+. Always feature-detect. Prefer parseHTML() or TrustedHTML for security.

Frequently Asked Questions

It is a static method that parses HTML into a new Document. Unlike parseHTML(), it does not sanitize by default — all HTML entities in the input are injected unless you pass a sanitizer (MDN).
No. MDN marks Document.parseHTMLUnsafe() as Baseline 2025 Newly available (since September 2025). It is not Deprecated, Experimental, or Non-standard.
MDN: almost always, on browsers where parseHTML() is supported, because it always removes XSS-unsafe HTML entities. Use parseHTMLUnsafe() only for trusted HTML, TrustedHTML workflows, or when you pass an explicit sanitizer.
MDN: content type "text/html", character set UTF-8, and URL "about:blank" — same shape as parseHTML().
No by default. MDN warns it is an injection sink and a possible XSS vector. Prefer TrustedHTML with Trusted Types CSP, or pass sanitizer: "default" / a custom Sanitizer.
Optional Sanitizer, SanitizerConfig, or the string "default" (XSS-safe default config). If omitted, no sanitizer runs and all HTML is injected (MDN).

Next: adoptNode()

Learn how to move a node from another document into the current one.

adoptNode() tutorial →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

13 people found this page helpful

JavaScript Document parseHTML() Method JavaScript Document adoptNode() Method