Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In forums, I see more and more questions that use jsfiddle or jsbin to share live examples.

My question: are these links safe? Would it be possible that somebody includes malicious code in a public jsfiddle or jsbin page?

share|improve this question

migrated from stackoverflow.com Jan 25 '12 at 8:41

This question came from our site for professional and enthusiast programmers.

JsFiddle is safe. We use a completely different domain for displaying the results so there's no same-domain privacy issues - you can't poke around with someone's cookies, etc. – Oskar Krawczyk Jan 22 '12 at 9:34

Usually the risk is in being redirected to malicious code from server side. I don't think jsfiddle or jsbin have the capacity to harm as they are client side without there being malicious server side code that they are somehow perpetuating.

share|improve this answer

It is possible that someone may include code in a jsFiddle that is executed when you click the link. By using commonly known codes for crashing certain browsers they maybe able to crash your browser.

Someone could send you into popup hell or down a link path that is hard to escape or lock your browser with processor intensive operations.

In general these are very unlikely and will likely not cause an permanent damage to your machine.

share|improve this answer

Of course it is as possible to include malicious code there as in every other page. The JS is directly evaluated.

Add-ons like NoScript for Firefox can help here where you can for example temporarily enable JS for JSFiddle, permanently for SO and never for XYZ.

share|improve this answer
ok. The big difference is that on standard sites the scripts are under control of the site owner, that you can decide to trust or not. While places like jsfiddle or jsbin accept "collaborative scripting". – Christophe Jan 21 '12 at 19:36
@Christophe But would you know whether the site owner has malicious code in there? Maybe because of a security issue within his CMS? Thats what NoScript is for. – TimWolla Jan 21 '12 at 19:37
if I have a doubt, my choice is not to visit the pages. This is my current issue with jsfiddle. – Christophe Jan 21 '12 at 20:34
@Christophe You should really try NoScript (If you are using firefox) then. You can temporarily enable JS for JSFiddle and Permanently for SO and never for XYZ. – TimWolla Jan 21 '12 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.