Is it safe to open an HTML file someone sent me? How to check first

An .html file arrives in your inbox or a chat: a quiz from a teacher, a game a friend made with ChatGPT, or an "invoice" you weren't expecting. Most HTML files are ordinary web pages. Some are phishing: they open a sign-in box that looks like Microsoft's or your bank's, and send the password to whoever made the file. This guide shows how to tell them apart, how to look inside a file without running it, and what to do if you already typed a password.

What an HTML file can do that a photo can't

A photo shows what's in it. An HTML file is a web page. Open it in a browser and it can run JavaScript, show a form, load pictures and scripts from other sites, and send what you type into the form to a server anywhere.

Microsoft's threat researchers have documented 2 kinds of attack that start with an HTML attachment:

• A fake sign-in box. In an invoice-themed campaign that Microsoft followed for a year, opening the attachment showed a fake Microsoft Office 365 sign-in box on top of a blurred Excel sheet. Some showed the target's email address and company logo. The password typed into it went to the attackers (Microsoft, August 12, 2021).
• A file built inside the browser. In what Microsoft calls HTML smuggling, the page assembles a file in the browser and saves it to the Downloads folder, so no program passes through the mail filter. The attack still needs the person to open what was saved (Microsoft, November 11, 2021).

Mail services let .html files through by default. Gmail's list of blocked attachment types includes .hta, .js, and .exe, but not .html. Outlook blocks .hta, .mht, and .mhtml, but not .htm or .html. Google says it scans every message for malware, and Microsoft 365 scans email for malware by default. Microsoft also writes that HTML smuggling "could bypass standard perimeter security controls, such as web proxies and email gateways." So a file that reached your inbox may still be one of these.

Red flags in an HTML file

Any one of these is a reason not to open the file in your browser:

• You weren't expecting it. CISA's advice on attachments is to "be wary of unsolicited attachments, even from people you know," because a sender's address can be faked. Ask the person in another way, by phone or a new message, not by replying.
• The name pretends to be another kind of file, such as invoice.xls.html or report.pdf.html. Microsoft notes that "xls" in the file name "is meant to prompt users to expect an Excel file."
• It asks you to sign in to see a document. A file on your own device has no reason to ask for your email or work password. The attachment Microsoft followed said the reader's access to the spreadsheet had "timed out."
• It already knows you. Your email address is filled in, or your company's logo is on it. Microsoft saw both in the fake sign-in box.
• The message pushes you to act now, or claims to come from your bank, IT, or a government office. The UK's National Cyber Security Centre (NCSC) lists authority, urgency, emotion, and scarcity among the tell-tale signs of a scam.
• The code is mostly unreadable when you open the file as text: long runs of random-looking letters and digits. Microsoft's mail protection flags an HTML file that "decodes a Base64 code or obfuscates a JavaScript."
• It saves a file, or asks you to open one, sometimes with a password to type. Microsoft saw an attachment that saved a password-protected script to the Downloads folder and showed its password on the page.

Check an HTML file before you open it, in 4 steps

These steps look at the file without letting its code run, and none of them upload it.

1. Save the file, and don't double-click it

Save the attachment to your device first. On a computer, double-clicking an .html file opens it in your browser, where its scripts run. On a Mac, that's the browser named under Open with in the file's Get Info window, as How to open an HTML file on a Mac shows. On an iPhone, tapping the file in Files opens a Quick Look preview, which ran no JavaScript and loaded nothing from the web in our iOS 26.3 test (How to open an HTML file on iPhone). Even there, don't type anything into it.

2. Read it as text

Open the file as plain text, and you see its code instead of the page. On a Mac, open TextEdit, choose File > Open, select the file, click Show Options, and select Ignore rich text commands, as Apple's TextEdit guide describes. Without that option, TextEdit shows the file as formatted text, the way a browser would. On Windows, Microsoft describes Notepad as an editor for "text-based files and source code." We didn't test Notepad ourselves.

Look for these in the code:

• type="password": a box for a password
• <form with an action= that points to a site you don't know: that's where the form sends what you type
• long blocks of random-looking letters and digits: code that has been encoded so you can't read it
• <script src= with a site you don't recognize

A page you expected, such as a quiz, reads as something you can follow: headings, questions, styles, and a script that checks answers.

3. Or open it in a viewer with scripts off

To see what the page looks like without letting it run, open Convika's free HTML viewer, uncheck Run scripts, then choose the file. The page shows its HTML and CSS only. Your browser reads the file, and it isn't uploaded: the viewer sends a page to Convika only when you press Get a link by uploading this page.

We tested a page built to misbehave in a local copy of the viewer on October 25, 2026, in Playwright's Chromium 156, Firefox 157, and WebKit 27.2 builds. With Run scripts off, no script ran, its Sign in button sent nothing, its download link saved nothing, and its links opened no new tab and left the viewer's tab where it was. 2 things still happened: an image from another site loaded, so the page's maker could see it was opened, and a plain link, when clicked, loaded the other site inside the viewer's frame.

4. Decide, then open it or delete it

If the code is a page you expected and nothing asks for a password, open it with scripts on: in the viewer with Run scripts checked, or in your browser. If it asks you to sign in, or you can't tell what the code does, don't open it. Delete it, or ask the sender about it by phone or in a new message.

Ways to look at an HTML file, compared

What the viewer's sandbox stops, and what it doesn't

Convika's viewer draws the page inside a sandboxed frame, which limits what the page's code may do. The frame never gets the tokens that would let it act as convika.com, open pop-ups or alert boxes, or move your tab. This is what our October 25 test saw, the same in all 3 browsers:

So the sandbox stops the file from reading convika.com, opening windows, or saving files, but not from showing you a form. The viewer doesn't scan files for malware, and it doesn't make a file safe. A fake sign-in box looks just as real inside it, and with scripts on, what you type into it can reach the person who made it. Don't type a password into any page you didn't expect, in the viewer or anywhere else.

When it's fine to let it run

Scripts are what make a quiz keep score, a game move, or a chart draw. Let them run when:

• you made the file, or asked ChatGPT, Claude, or Gemini for it and downloaded it yourself
• someone you know told you it was coming, and the code passed the checks above
• your teacher or a colleague confirmed, in person or by phone, that they sent it

A file that someone says an AI made is still a file from that person, so check it like any other. And a page you trust still has no reason to ask for a password you use elsewhere.

What Gmail and Outlook do with HTML attachments

• Gmail won't let anyone attach the types on its blocked list, such as .hta, .js, and .exe, even inside a .zip. .html isn't on the list.
• Outlook blocks .hta, .mht, and .mhtml attachments, but not .htm or .html. In Microsoft 365, an admin can add htm and html to the anti-malware policy's common attachments filter, which then rejects or quarantines those files. They aren't on its default list.

So an .html file that reaches a personal inbox can be rejected or quarantined at a school or a company whose admin added it to that filter.

At school or work, tell IT

On a school or work account, report the message instead of deleting it quietly. The NCSC says to contact your IT department if you received a scam message on a work laptop or phone. CISA's tip is to use the report option next to the sender's name or the "report spam" button. An admin can then filter the file type for everyone, as Microsoft's anti-malware documentation describes.

If you already opened it or typed a password

The NCSC's guidance for someone who has shared information with a scammer comes down to these steps:

• You typed a password: change it on that account and on every other account that uses the same password. The NCSC suggests a passkey where one is available, and Microsoft's researchers recommend multi-factor authentication, which limits what a stolen password is worth.
• It was a work or school device: tell your IT department.
• You opened a file it saved, or installed something: run a full scan with your antivirus software and let it clean up what it finds.
• You gave bank or card details: contact your bank.

If you only read its code as text, or opened it in the viewer with Run scripts off and typed nothing, its scripts didn't run.

Sending an HTML file? Send a link instead

If you made the file and want someone to open it, a link spares them every check above. Drop your file in the box above, or paste the code, to get a preview link without an account. That preview runs no scripts. Click Keep this page — free, no card and sign up, and the page moves into your account, where its scripts run and you can publish it. Don't upload a file someone else sent you just to check it: the steps above check it on your own device.

How to send an HTML file by email covers the sender's side of an attachment. A file shared through Google Drive opens as code or a download, not as a page (How to share an HTML file in Google Drive).

Frequently asked questions

Can an HTML file have a virus?

Yes, it can carry one in. An HTML file is code your browser runs, and Microsoft has documented HTML attachments that build a malicious file inside the browser and save it to the Downloads folder (November 2021). That attack still needs you to open what was saved. Others carry no malware at all and show a fake sign-in box to steal a password. Open an HTML file only if you expected it, and check it as text or with scripts off first.

Is it safe to open an .html attachment?

Yes, if you expected it and you know who sent it, such as a quiz your teacher said was coming. If it arrived out of the blue, comes "from" a bank or IT, or asks you to sign in, don't open it in your browser. Save it and read it as text, or open the HTML viewer and turn off Run scripts before you choose the file. Ask the sender about it by phone or in a new message, not by replying.

How can I check an HTML file without running it?

Open it as plain text. On a Mac, open it in TextEdit with Ignore rich text commands selected in the Open dialog, and TextEdit shows the HTML code, as Apple's guide describes. On Windows, Microsoft describes Notepad as an editor for text-based files and source code; we didn't test it. To see the page itself, open Convika's HTML viewer, uncheck Run scripts, and choose the file. It shows the HTML and CSS only, and the file isn't uploaded.

Why did I get an HTML attachment asking me to sign in?

Because it's most likely phishing. A file on your device has no reason to ask for your email or work password. In a campaign Microsoft followed for a year, the attachment showed a fake Office 365 sign-in box over a blurred spreadsheet, said the reader's access had timed out, and sent the typed password to the attackers. Don't type anything into it. If you already did, change that password now.

Is it safe to upload my HTML file to an online viewer?

It depends on the viewer: some read the file in your browser, and some send it to a server. Convika's HTML viewer reads it in your browser, and the page goes to Convika only if you press Get a link by uploading this page. Check before you open a private file in any other viewer. In our October 25 test, Tiiny Host's viewer sent the code to the W3C's validator, as its page says, and Code Beautify and Tiiny Host ran the page's scripts with no sandbox. Online HTML viewers compared shows what each one did.

Does opening an HTML file in Notepad or TextEdit run it?

Not in TextEdit's code view. Select Ignore rich text commands when you open the file, or turn on Display HTML files as HTML code instead of formatted text in TextEdit's settings, and TextEdit shows the code, as Apple's guide describes. Without either, it shows the file as formatted text, the way a browser would, and we didn't test what that view runs or loads. Microsoft describes Notepad as an editor for text-based files and source code; we didn't test Notepad. For a file you don't trust, use TextEdit's code view, or the HTML viewer with Run scripts off.

Is an HTML file from ChatGPT safe to open?

Yes, if you asked ChatGPT for it and downloaded it yourself: it runs the code ChatGPT wrote for you. A file someone else sends you and says came from ChatGPT is a file from that person, so check it like any other. Either way, a quiz or a game has no reason to ask for a password you use elsewhere.

What should I do if I typed my password into an HTML file?

Change that password now, on that account and on any other account that uses the same one, as the NCSC advises. Turn on multi-factor authentication if the account offers it. If it was a work or school account, tell your IT department right away, and if you gave bank details, contact your bank.

Sources

• Attackers use Morse code, other encryption methods in evasive phishing campaign (Microsoft Threat Intelligence, August 12, 2021) (checked October 25, 2026)
• HTML smuggling surges (Microsoft Threat Intelligence, November 11, 2021) (checked October 25, 2026)
• Using Caution with Email Attachments (CISA, February 1, 2021, archived) (checked October 25, 2026)
• Recognize and Report Phishing (CISA, archived) (checked October 25, 2026)
• How to spot a scam email, text message or call (NCSC) (checked October 25, 2026)
• Phishing scams: If you've shared sensitive information (NCSC, reviewed September 5, 2022) (checked October 25, 2026)
• File types blocked in Gmail (Gmail Help) (checked October 25, 2026)
• Advanced phishing and malware protection (Google Workspace Admin Help) (checked October 25, 2026)
• Blocked attachments in Outlook (Microsoft Support) (checked October 25, 2026)
• Anti-malware protection in EOP (Microsoft Learn) (checked October 25, 2026)
• Windows Notepad (Microsoft Store) (checked October 25, 2026)
• Work with HTML documents in TextEdit on Mac (Apple) (checked October 25, 2026)
• The iframe element and its sandbox attribute (MDN) (checked October 25, 2026)