TrustedTypePolicy: createHTML() method

Baseline 2026

Newly available

Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.

Note: This feature is available in Web Workers.

The createHTML() method of the TrustedTypePolicy interface creates a TrustedHTML object using a policy created by TrustedTypePolicyFactory.createPolicy().

Syntax

js
createHTML(input)
createHTML(input, args)

Parameters

input

A string containing the string to be sanitized by the policy.

args Optional

Additional arguments to be passed to the function represented by TrustedTypePolicy.

Exceptions

TypeError

Thrown if TrustedTypePolicy does not contain a function to run on the input.

In the below example a string containing a potentially dangerous script is used as the input for createHTML(). Dangerous code inserted by a user could then be sanitized before insertion into any injection sink.

const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");

Specifications

Specification

Trusted Types
# dom-trustedtypepolicy-createhtml

Browser compatibility

Enable JavaScript to view this browser compatibility table.

Help improve MDN

Was this page helpful to you?

Yes No

Learn how to contribute

This page was last modified on May 13, 2024 by MDN contributors.

View this page on GitHub • Report a problem with this content