Element.getAttribute() is an instance method that reads an HTML attribute value from an element. Learn when it returns null, how data-* attributes work, decoded entity values, the CSP nonce security note, and five try-it labs aligned with MDN.
01
Kind
Instance method
02
Arg
attribute name
03
Returns
string or null
04
Missing
null
05
HTML
names lower-cased
06
Status
Baseline widely
Fundamentals
Introduction
HTML attributes carry metadata: id, class, href, data-action, and more. In JavaScript you can read many reflected properties directly (el.id), but getAttribute(name) works for any attribute name as a string.
If the attribute is not present, you get null—not an empty string. That distinction matters when you branch on whether an attribute exists.
💡
Beginner tip
MDN warns: values from getAttribute() are already decoded. Never assign untrusted attribute values to innerHTML—use textContent instead to avoid XSS.
getAttribute("data-action") and dataset.action both read the same value; choose the style that fits your codebase.
Example 4 — Decoded Character References (MDN)
HTML entities in markup are decoded in the returned string.
JavaScript
// <div data-payload="<b>hi</b>"></div>
const el = document.getElementById("example");
console.log(el.getAttribute("data-payload"));
// "<b>hi</b>" (decoded — do NOT use with innerHTML)
getAttribute returns the literal attribute string. For links, getAttribute("href") returns the attribute value as written (which may differ slightly from the resolved link.href property).
Applications
🚀 Common Use Cases
Reading data-* hooks for event delegation (data-action).
Inspecting aria-* attributes for accessibility tooling.
Feature detection via custom data-feature flags in HTML.
Reading role, tabindex, or other attributes without IDL shortcuts.
Serializing element state when attributes mirror configuration.
Teaching the difference between attribute values and reflected properties.
🧠 How getAttribute() Looks Up Values
1
Pass an attribute name
el.getAttribute("data-id") — HTML docs lower-case the name.
Name
2
Search element attributes
The browser checks whether the element has that attribute in its attribute map.
Lookup
3
Return decoded string or null
If found, return the decoded value; if not, return null.
Result
4
✓
Use safely in your code
Null-check, avoid innerHTML with untrusted values, use .nonce for CSP nonces.
Important
📝 Notes
Not Deprecated, Experimental, or Non-standard on MDN (Baseline Widely available, July 2015).
Missing attributes return null, not "".
Returned values are decoded—XSS risk if inserted as HTML (MDN).
getAttribute("nonce") on scripts returns ""—use script.nonce.
Element.getAttribute() is Baseline Widely available (MDN: across browsers since July 2015). Logos use the shared browser-image-sprite.png sprite from this project.
✓ Baseline Widely available
Element.getAttribute()
Read any HTML attribute value as a string — or null when missing.
BaselineWidely available
Google ChromeSupported · Desktop & Mobile
Yes
Microsoft EdgeSupported · Chromium
Yes
Mozilla FirefoxSupported · Desktop & Mobile
Yes
Apple SafariSupported · macOS & iOS
Yes
OperaSupported · Modern versions
Yes
Internet ExplorerSupported in legacy IE
Yes
getAttribute()Excellent
Bottom line: Use getAttribute() for generic attribute reads. Null-check results, prefer textContent for untrusted data, and use script.nonce instead of getAttribute('nonce').
Wrap Up
Conclusion
Element.getAttribute() is the straightforward way to read any HTML attribute as a string. Remember null when missing, decoded values for security, and the nonce exception on script elements.
Confuse attribute strings with boolean IDL properties
Forget HTML lower-cases attribute names in documents
Summary
Key Takeaways
Knowledge Unlocked
Five things to remember about Element.getAttribute()
Read any attribute — string or null.
5
Core concepts
📝01
Returns
string | null
API
📄02
Missing
null
Check
✍️03
data-*
or dataset
Pattern
✅04
Baseline
widely available
Status
⚡05
Security
no innerHTML
XSS
❓ Frequently Asked Questions
It returns the value of a named HTML attribute on the element as a string. If the attribute does not exist, it returns null.
No. MDN marks Element.getAttribute() as Baseline Widely available (across browsers since July 2015). It is not Deprecated, Experimental, or Non-standard.
null. Always check for null before using the value, or use hasAttribute() first.
IDL properties like id reflect specific attributes and may have different types or defaults. getAttribute() always returns a string or null for any attribute name you pass.
You can use getAttribute('data-id') or the dataset API (el.dataset.id). dataset is often cleaner for data-* names; getAttribute works for any attribute.
For CSP security, nonce values are hidden from getAttribute on script elements. Use the nonce property instead: script.nonce.
Did you know?
On HTML elements, getAttribute("ID") and getAttribute("id") are equivalent—the browser lower-cases the name before lookup. In XML documents, attribute names are case-sensitive.