An in-browser preview is only as safe as what it refuses to keep. A sanitizer removes active content by allowlist, and the sandboxed frame is a second layer that stops anything that slips through.
01What a safe preview removes
Script and style elements, embedded documents and SVG or MathML content.
Every event-handler attribute and inline style.
URLs whose scheme (even entity-encoded) is javascript:, data:, vbscript:, blob: or file:.
External resource loaders, so the preview makes no network request.
02Local-only autosave
Autosave stores one key per tool in your own browser and only after you turn it on. Clear or Reset removes the stored document; there is no server, upload or retention.
Frequently asked questions
Is the sandbox the only protection?
No. The markup is sanitized first, then rendered in a sandboxed frame as defense in depth.
Where is the autosaved document?
Only in your browser, under one key per tool, and only when you enable autosave. Clear or Reset deletes it.
A practical guide to choosing random passwords and tokens, deriving and storing password hashes, signing tokens, encrypting with authenticated modes and measuring entropy.