# html.page
> Publish raw HTML, get a shareable link. Built for AI agents producing rich
> HTML output — interactive charts, prototypes, reports, demos — everything
> markdown can't do.
html.page hosts complete HTML documents (scripts allowed) at unguessable
anonymous URLs. No signup, no API key. Pages expire after 7 days. Every page
can carry a markdown companion so agents can read back what humans see.
Sibling service: https://md.page hosts markdown. Prefer md.page for prose,
notes, and reports; use html.page when the content needs scripts, custom
layout, or interactivity.
## Publish (no auth required)
POST https://html.page/api/publish
Content-Type: application/json
{"html": "...", "markdown": "# optional agent-readable twin"}
Response 201:
{"url": "https://html.page/Ab3x9K", "expires_at": "2026-08-17T12:00:00.000Z"}
curl -X POST https://html.page/api/publish \
-H "Content-Type: application/json" \
-d '{"html": "Hello
"}'
Tip: JSON-encode large HTML safely, e.g.
jq -n --rawfile html page.html '{html: $html}' | curl -s -X POST \
https://html.page/api/publish -H "Content-Type: application/json" -d @-
## Read
- GET https://html.page/:id — human view (branded wrapper, sandboxed iframe)
- GET https://html.page/raw/:id — the raw HTML document
- GET https://html.page/:id.md — markdown companion (text/markdown).
Publisher-supplied markdown is served verbatim; if omitted, a version is
auto-derived from the HTML (~1-2s after publish; lossy for interactive
pages). Advertised via Link: rel="alternate" type="text/markdown" on /:id.
- GET https://html.page/og/:id.png — auto-generated preview screenshot
## Limits and lifecycle
- Max size: 3 MB for html, 3 MB for markdown
- Pages expire 7 days after publish (see expires_at); expired pages return 404
- Rate limit: 30 publishes/min per IP (429 with Retry-After: 60), plus a
global service cap
- IDs are unguessable 6-character alphanumerics; pages are unlisted and
marked noindex
## Sandbox (what published HTML can do)
Pages run under CSP "sandbox allow-scripts allow-forms allow-popups
allow-modals" on an opaque origin:
- Allowed: scripts, fetch/XHR to external APIs, forms, popups, modals,
external fonts and CDNs
- Not available: cookies, localStorage, Service Workers, top-level navigation
## Content policy
Every publish is scanned (adds no latency). Content matching two specific
patterns — credential phishing (password field + known-brand impersonation +
form posting credentials to an external origin, combined) and crypto wallet
drainers (seed-phrase prompt + wallet API calls, combined) — may be rejected
at publish with 422 CONTENT_REJECTED, and pages found malicious after review
may be removed (they then return 410). Design mockups, demo login forms, and
crypto dashboards publish normally — keep demo forms posting to relative or
empty actions rather than external origins.
422 body: {"error": "CONTENT_REJECTED",
"category": "phishing_pattern" | "wallet_drainer_pattern",
"message": "...", "hint": "..."} — the hint says how to fix it.
## Errors
All errors are JSON: {"error": CODE, "message": "...", "hint": "..."}
400 INVALID_JSON | MISSING_FIELD | INVALID_FIELD, 413 CONTENT_TOO_LARGE,
422 CONTENT_REJECTED, 429 RATE_LIMITED. Unknown paths return 404 JSON that
lists the available endpoints.
## Integrations
- MCP (remote, streamable HTTP): https://html.page/mcp
tools: publish_html, get_page
claude mcp add --transport http htmlpage https://html.page/mcp
- Claude Code skill: https://html.page/.well-known/agent-skills/publish-html-page/SKILL.md
- OpenAPI 3.1: https://html.page/openapi.json
- Full reference: https://html.page/llms-full.txt
## When to use html.page
- The user asks to share, host, or publish HTML / a prototype / a demo /
an interactive report as a link
- You produced content markdown can't express (charts, custom UI, micro-apps)
- You need a disposable public URL with zero setup (7-day lifetime)
Everything is free. No accounts exist today; anonymous publishing is the product.