The sandbox attribute on an <iframe> element applies extra restrictions to the content embedded within it. When present without any value (i.e., sandbox=""), it blocks all privileged actions: scripts, forms, popups, plugins, and same-origin access are all disabled. You then selectively re-enable capabilities by adding tokens like allow-scripts, allow-forms, etc. It's a critical security mechanism for embedding untrusted third-party content.

Even trusted third-party content can be compromised. A sandboxed iframe follows the principle of least privilege: grant only the permissions the embedded content genuinely needs. This mitigates risks like XSS attacks, malicious redirects, forced downloads, or cookie theft. Sandbox is a defense-in-depth measure that protects your users even if the embedded source is breached.

When both allow-scripts and allow-same-origin are present, the iframe can execute JavaScript that has access to the parent page's origin — including cookies, localStorage, and DOM if same-origin. More critically, the iframe can remove its own sandbox attribute via JavaScript, completely escaping the restrictions. Never combine these two tokens for untrusted content. If you must use both, ensure the iframe content is fully trusted and served from a separate origin.

Use this configurator tool! Enable/disable tokens and observe the live preview iframe. Key indicators: (1) If allow-scripts is off, JavaScript won't execute at all. (2) If allow-modals is off, alert() calls silently fail. (3) If allow-forms is off, form submissions are blocked. (4) If allow-popups is off, window.open() returns null. The test results panel above receives real-time feedback via postMessage from the iframe when scripts are allowed.

allow-popups-to-escape-sandbox: When combined with allow-popups, popup windows opened by the iframe will not inherit the sandbox restrictions. They open as fully-privileged windows. Without this token, popups also carry the sandbox limitations.

allow-top-navigation-by-user-activation: When combined with allow-top-navigation, top-level navigation (changing top.location) is only permitted when triggered by a genuine user gesture (click, tap, keypress). This prevents automated redirects while still allowing legitimate user-initiated navigation.

No sandbox attribute: The iframe operates with full permissions — scripts run, forms submit, popups open, and same-origin access is granted (subject to normal same-origin policy). There are zero additional restrictions.

sandbox="": The iframe is maximally restricted. Everything is blocked: no scripts, no forms, no popups, no same-origin access, no modals, no downloads, no pointer lock, no top navigation. You must explicitly add tokens to re-enable specific capabilities. This is the safest starting point for untrusted content.

The core sandbox attribute and most tokens (allow-scripts, allow-same-origin, allow-forms, allow-popups, allow-modals, allow-top-navigation) are supported in all modern browsers including Chrome, Firefox, Safari, and Edge. Newer tokens like allow-popups-to-escape-sandbox, allow-top-navigation-by-user-activation, allow-downloads, and allow-presentation also have broad modern support but may be absent in older browsers. Always test your target browser matrix and provide fallbacks when necessary.

1. Start strict: Begin with sandbox="" (empty) and add only the tokens you need.
2. Never combine allow-scripts + allow-same-origin for untrusted content.
3. Use allow-popups-to-escape-sandbox sparingly — only when popups genuinely need full privileges.
4. Prefer allow-top-navigation-by-user-activation over bare allow-top-navigation to prevent automated redirects.
5. Test thoroughly: Use this configurator to verify your sandbox behaves as expected before deploying.
6. Combine with CSP: Use Content Security Policy headers on the embedded content as an additional security layer.
7. Monitor: Use postMessage to communicate between iframe and parent rather than relying on same-origin access.