What does an empty sandbox attribute do?

An empty sandbox (sandbox="") applies the maximum set of restrictions: scripts disabled, forms disabled, the frame forced into a unique opaque origin, popups blocked, top-level navigation blocked, plugins blocked, and more. Each token you add relaxes exactly one restriction.

Why is allow-scripts plus allow-same-origin dangerous?

When both are present, the framed document runs scripts and shares the embedder's origin, so it can reach into the parent's DOM and even script-remove its own sandbox attribute. That combination effectively defeats the sandbox, so only use it for content you fully trust.

Does sandbox replace the need for a Content Security Policy?

No. sandbox restricts the framed document's capabilities, while CSP controls what resources a page may load and where. They are complementary layers. A hardened embed typically uses both a tight sandbox and a restrictive CSP.

What is allow-top-navigation for?

By default a sandboxed frame cannot navigate the top-level browsing context, which stops framed ads or content from redirecting the whole page. allow-top-navigation re-enables that; allow-top-navigation-by-user-activation only permits it in response to a real user gesture, which is safer.

Are sandbox tokens space-separated or comma-separated?

Space-separated, like class names. The attribute looks like sandbox="allow-scripts allow-forms". Commas are not valid and will be treated as part of the token text, silently disabling the affected tokens.

What is the iframe sandbox Attribute Tokens?

Reference for the HTML iframe sandbox attribute tokens including allow-scripts, allow-forms, allow-same-origin, allow-popups and allow-top-navigation, with what each re-enables and the secure default block list. It runs free in your browser on Gera Tools, with nothing uploaded.

iframe sandbox Attribute Tokens

Name: iframe sandbox Attribute Tokens
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

What the iframe sandbox attribute does

The sandbox attribute on an <iframe> runs the embedded document under a set of additional restrictions on top of the same-origin policy. The moment you add the attribute, almost everything is switched off: scripts, forms, popups, top-level navigation, the document’s own origin, plugins, and pointer lock. You then opt back in to specific capabilities by listing allow-* tokens. This “deny by default, allow explicitly” model is why sandbox is a core tool for safely embedding untrusted third-party content.

Token quick-reference

Token	What it re-enables	Risk level
`allow-scripts`	JavaScript execution	Medium — combine with care
`allow-forms`	Form submission	Low
`allow-same-origin`	Frame keeps its real origin	High — dangerous with allow-scripts
`allow-popups`	`window.open()`, `target=_blank` links	Medium
`allow-top-navigation`	Navigate the top browsing context	High
`allow-top-navigation-by-user-activation`	Top navigation only after a user gesture	Lower than unconditional
`allow-modals`	`alert()`, `confirm()`, `prompt()`	Low
`allow-pointer-lock`	Pointer Lock API	Low
`allow-popups-to-escape-sandbox`	Popups open without inheriting sandbox	Medium
`allow-downloads`	Downloads via anchor or form	Low

How it works

Tokens are space-separated inside the attribute value:

<iframe src="widget.html" sandbox="allow-scripts allow-forms"></iframe>

Each token re-enables exactly one feature. With no tokens the frame is maximally locked down and is also forced into a unique opaque origin, so even same-origin content is treated as cross-origin. The single most important rule: combining allow-scripts with allow-same-origin lets the framed page script its own sandbox away, so reserve that pairing for fully trusted content. The toggler below builds the attribute and flags that dangerous combination.

Practical examples

Embedding a third-party widget (e.g. a comment box):

<iframe src="https://comments.example/widget"
  sandbox="allow-scripts allow-forms allow-popups">
</iframe>

Scripts and forms are needed for the widget UI. Popups may be needed for OAuth flows. allow-same-origin is deliberately omitted.

Sandboxed code preview (untrusted user code):

<iframe srcdoc="..." sandbox="allow-scripts"></iframe>

Scripts run so the preview is interactive, but the frame is forced into an opaque origin so it cannot access cookies or storage.

Read-only content embed (no interaction needed):

<iframe src="/embed/article" sandbox=""></iframe>

An empty sandbox is the maximum lockdown. Use it for decorative or purely informational embeds.

Tips

Prefer allow-top-navigation-by-user-activation over the unconditional allow-top-navigation so framed content can only redirect the page after a real click. allow-popups-to-escape-sandbox lets popups open without inheriting the restrictions — useful for legitimate auth flows, risky for ads. Sandbox pairs naturally with Content-Security-Policy and referrerpolicy; treat them as layers, not substitutes.

Tokens are space-separated — do not use commas. A typo in a token name is silently ignored rather than causing an error, so double-check the spelling of each token you add.