What runs where
The editor itself is CodeMirror 6 with multi-cursor editing, regex search and replace, folding, autocomplete with snippets, bracket matching and inline diagnostics computed in a Web Worker. Your files live in a virtual project with folders and tabs, split views and a command palette (Ctrl/Cmd+Shift+P).
When you press Run, page code renders in the striped preview on the right. That frame has an opaque origin: it can run scripts, but it cannot touch this page, your saved projects or your cookies. Its Content Security Policy blocks every network request until you switch Network on, and the editor lists external URLs before you do. Standalone scripts and tests run in a Worker inside another sandbox, which Stop terminates instantly.
| Capability | Status | How and limits |
|---|---|---|
| HTML, CSS and JavaScript preview | NATIVE | Opaque-origin iframe; network blocked until you allow it; loop guard. |
| TypeScript, JSX and TSX | APPROX | Compiled by Sucrase in a Worker. Types are stripped, not checked. |
| React components | WASM | Bundled React 18.3.1 runtime; only react, react-dom and project files can be imported. |
| JavaScript in a Worker, tests | NATIVE | Terminable Worker with a hard time limit; Jest-style describe/test/expect subset. |
| Formatting | WASM | Prettier 3 for JS/TS/CSS/HTML/Markdown/YAML/JSON, sql-formatter, XML pretty printer. |
| Lint and diagnostics | APPROX | Syntax errors plus an ESLint-style subset of 11 configurable rules. |
| Python | WASM | Optional Pyodide 0.28.3 (about 12 MB), loaded only after you opt in. No pip or input(). |
| SQL | WASM | SQLite through sql.js, bundled, in-memory per run. |
| JSON, YAML, XML, Markdown, SVG | NATIVE | Validation with positions, sanitised Markdown and SVG previews. |
| Java, Rust, Go, C, C++, PHP | UNSUPPORTED | Highlighting and editing only. No compiler runs in this browser build. |
| Type checking, npm installs, minimap | UNSUPPORTED | Not in this release. Listed so nothing is implied. |
NATIVE: built-in browser API. WASM: bundled library or WebAssembly runtime. APPROX: bounded best effort. UNSUPPORTED: not possible in this browser-only build today.
Projects that stay yours
Drop files, whole folders or a ZIP onto the workspace. Paths are validated, so an archive entry like ../../etc/passwd is refused instead of written. Export a project as a ZIP with a versioned manifest, as a single JSON file, or file by file. Local history keeps up to 50 snapshots per project, and any snapshot can be compared side by side with the current file before you restore it.
Questions
Is my code uploaded?
No. Editing, running, formatting and saving happen in your browser. Projects live in IndexedDB on this device; there is no account and no server that receives your code.
How is running untrusted code kept safe?
Previews run in an iframe sandbox without same-origin rights, so they cannot read this site, your projects or cookies. A Content Security Policy blocks network requests by default. Scripts without a page run in a Web Worker that can be terminated at any time.
Does it work offline?
Yes, after one visit online. A service worker caches the app so you can open, edit, preview and export projects without a connection. The optional Python runtime works offline once it has been loaded.
How do I keep my work?
Projects autosave in this browser and you can take snapshots with Ctrl/Cmd+S. Browsers can clear storage, so export a ZIP or project JSON for anything important.
Which languages can actually run?
HTML/CSS/JavaScript, TypeScript, JSX/TSX (React), Python via Pyodide and SQL via SQLite. Other languages are edit-only and are clearly labelled.