Your files stay on your device

Iframe sandbox policy builder

Answer what you embed and tick the capabilities you need, then copy the smallest sandbox attribute that still works, warnings included.

Sandbox tokens are a blunt instrument: allow-scripts plus allow-same-origin on your own origin hands the frame full access to everything, because its script can strip the attribute and reload unsandboxed. On another origin the same pair only gives the frame back its own cookies and storage, which is a trade you may accept knowingly. This tool writes the attribute and grades the combination. It does not render a live frame, and it cannot see the CSP header the framed page ships.
Options

More web & auth tools

- CSP evaluator & builder (/web/csp)
- Subresource integrity (/web/sri)
- HTTP header parser (/web/headers)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/iframe-sandbox-policy-builder
Markdown version: https://nutter.tools/web/iframe-sandbox-policy-builder.md
Plain-text version: https://nutter.tools/web/iframe-sandbox-policy-builder.txt
Agent index: https://nutter.tools/llms.txt