Developer

JavaScript Online Runner

Run JavaScript in a sandboxed iframe — instant execution with console output capture.

Loading interactive tool…

Embed this tool on your site

About this tool

JavaScript Online Runner executes JavaScript code in a sandboxed iframe with no external dependencies. Each run builds a hidden iframe whose srcdoc holds a small console-override shim followed by your code, with the sandbox flag 'allow-scripts' only, and output is relayed back with postMessage. console.log, console.error, console.warn and console.info calls are captured; errors and warnings get ✖ and ⚠ markers and colours. Objects and arrays are printed with JSON.stringify(value, null, 2). Uncaught errors, including syntax errors, are caught by a window error listener. Each run is stopped after 5 seconds, so later timers or promises do not print. Because the tool uses no CDN or bundler, it loads instantly. Copy share link encodes your snippet as base64 in the URL fragment, so you can share runnable code without any backend. This tool is ideal for quickly testing JavaScript expressions, DOM-free algorithms, short async flows and JSON transformations.

Why use it

  • Zero dependencies — no CDN, no bundler, no npm install, starts instantly on the slowest connection.

  • Sandboxed execution — code runs isolated from the parent page

  • Captures the four main console methods with colour-coded output

  • Shareable snippets via encoded URL fragment

  • Works entirely in the browser — no server needed

How to use

  1. Type or paste JavaScript into the editor.
  2. Click Run JavaScript or press Ctrl/⌘ + Enter — output appears in the Output panel.
  3. Use console.log(), console.error(), console.warn(), and console.info() to inspect values.
  4. Click Copy share link to copy a URL that contains your snippet.
  5. Click Clear to wipe the console and stop a running snippet.

When it helps

  • Quickly testing a JavaScript expression, regex, or one-line algorithm
  • Demonstrating a code snippet to someone without a shared editor
  • Debugging logic before adding it to a larger project
  • Teaching JavaScript to students with an instant feedback loop
  • Validating short async/await flows or Promise chains

Examples

Map and filter

Input
const nums = [1, 2, 3, 4, 5, 6];
const evenSquares = nums.filter(n => n % 2 === 0).map(n => n * n);
console.log(evenSquares);
Expected result
[
  4,
  16,
  36
]

Async wait

Input
const wait = ms => new Promise(r => setTimeout(r, ms));
(async () => {
  console.log('start');
  await wait(500);
  console.log('after 500ms');
})();
Expected result
start
after 500ms

Object destructuring + JSON

Input
const user = { name: 'Ada', roles: ['admin', 'editor'], meta: { last: '2026-01-01' } };
const { name, roles: [primary] } = user;
console.log(JSON.stringify({ name, primary }, null, 2));
Expected result
{
  "name": "Ada",
  "primary": "admin"
}

Tips

  • Wrap top-level await calls in an async IIFE: (async () => { /* code */ })() — top-level await is not supported in script-mode iframes.
  • console.log already pretty-prints objects and arrays with JSON.stringify(value, null, 2); use console.log(String(arr)) for a one-line 4,16,36 style output.
  • Each Run resets the iframe — use it to clear stuck timers or intervals from a previous run.
  • URL-shared snippets travel in the fragment (#...) so they never hit the server, even when shared via chat or email.
  • Combine setTimeout with console.log to trace event-loop ordering and microtask vs macrotask behaviour; keep delays under 5 seconds.
  • Use performance.now() to benchmark small algorithms — the iframe has full access to the standard timing API.

Frequently Asked Questions

Is this safe to run untrusted code?
Code runs in a sandboxed iframe with sandbox='allow-scripts'. It cannot access the parent page's DOM, cookies, localStorage, or make credentialed requests.
Can I use ES modules or import()?
Not reliably. Your code runs as a classic script, so import statements are a syntax error. Dynamic import() of a full URL is not supported by the tool and only works if the remote server allows cross-origin requests.
Is my code sent to any server?
Never. Everything runs locally in your browser. The Share Link uses a URL fragment which is never sent to the server — only processed client-side.
What is captured in the output?
console.log, console.error, console.warn, and console.info calls are all captured and displayed with colour coding. Objects are serialised with JSON.stringify. Other methods such as console.table are not captured.
What happens on runtime errors?
Uncaught errors are caught by a window error listener inside the iframe and posted to the output panel in red, the same way a console.error call would appear. Unhandled promise rejections are not reported.
How long can code run?
Up to 5 seconds. After that the iframe is removed, so pending timers, intervals and promises stop and print nothing more.

Explore the category

Glossary

Sandboxed iframe
An HTML iframe with the sandbox attribute that restricts access to the parent page's DOM, cookies, top-level navigation, and form submission.
srcdoc
An iframe attribute that holds the HTML of the frame inline; this tool puts the console shim and your code there, so no network request is needed to load it.
postMessage
A browser API for cross-origin communication between windows or iframes, used here to relay console output from the sandbox back to the runner UI.
REPL
Read-Eval-Print Loop — an interactive evaluator. This tool is a script-mode REPL where each Run evaluates the full editor contents.
ES2020
The 11th edition of the ECMAScript standard, adding optional chaining (?.), nullish coalescing (??), BigInt, and dynamic import among other features.
Microtask vs Macrotask
Promise callbacks run on the microtask queue (immediately after current code), while setTimeout uses the macrotask queue (next event-loop tick).
Unhandled promise rejection
A rejected Promise without a .catch handler. Browsers raise an unhandledrejection event for it; this tool does not listen for that event, so such rejections do not appear in the output.
URL fragment
The portion of a URL after the # character; never sent to the server, making it safe for embedding shareable code without backend storage.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities