TrustedScript: toString() method

Baseline 2026

Newly available

Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.

Note: This feature is available in Web Workers.

The toString() method of the TrustedScript interface returns a string which may be safely inserted into an injection sink.

Syntax

toString()

None.

A string containing the sanitized script.

The constant sanitized is an object created via a Trusted Types policy. The toString() method returns a string to safely execute as a script.

js
const sanitized = scriptPolicy.createScript("eval('2 + 2')");
console.log(sanitized.toString());

Specification

Enable JavaScript to view this browser compatibility table.

Was this page helpful to you?

Yes No

This page was last modified on Mar 10, 2025 by MDN contributors.