coderef

Unsanitized HTML parsingBaseline · Newly available

The Document.parseHTMLUnsafe() static method parses HTML into a DOM tree, much like the setHTMLUnsafe() DOM method inserts HTML into an existing tree. No sanitization applies, so never call it with user-provided strings.

Works in the latest version of every major browser, but older devices may not support it yet. Baseline since Sep 15, 2025.

How to use ↓Compare browsers

Browser support

DesktopChrome
1–123Not supported
124+Supportedsince Apr 16, 2024
Current: 155
Edge
12–123Not supported
124+Supportedsince Apr 18, 2024
Current: 154
Firefox
1–127Not supported
128+Supportedsince Jul 9, 2024
Current: 157
Safari
1–18.6Not supported
26+Supportedsince Sep 15, 2025
Current: 27
MobileChrome Android
18–123Not supported
124+Supportedsince Apr 16, 2024
Current: 155
Firefox Android
4–127Not supported
128+Supportedsince Jul 9, 2024
Current: 157
Safari iOS
1–18.6Not supported
26+Supportedsince Sep 15, 2025
Current: 27

How to use

Every current browser supports this, but it only became Baseline on Sep 15, 2025. Use it as a progressive enhancement, or keep a fallback if you support older devices.

Example

Full syntax and examples are on MDN: parseHTMLUnsafe static.

Feature detection

JS · check before using
if ("Document" in globalThis && "parseHTMLUnsafe" in Document) {
  // Document.parseHTMLUnsafe is available
}

Documentation (MDN)

Specification