A real code editor with syntax highlighting and a live preview, not a bare textarea. Three sanitization profiles and site-wide admin guardrails, not an allowlist and good luck. And an architecture with zero external egress — your code renders in a sealed sandbox and never leaves your Atlassian site.
From install to rendered HTML in a couple of minutes — one macro, one full-screen editor, a live preview the whole way.
A one-time install, done from the Atlassian Marketplace.
Choose the Confluence site you want it on, and start the 30-day free trial. The app installs through Atlassian's Forge platform — there is no separate download.
Any page will do — the block brings everything with it.
/HTML Block where you want it.
Place your cursor and type /HTML Block, or open the + insert menu and search for HTML.
The full-screen editor opens automatically, ready for your code.
Write, preview, save — what you see is what readers get.
HTML, CSS and JS each get their own tab with syntax highlighting, line numbers and undo history. Or switch the source to an .html file attached to the page (up to 10 MB). Up to 100 KB of code per block.
The right pane re-renders as you type, through the exact same pipeline the published page uses. If sanitization removes anything, a banner tells you exactly what.
Strict for formatting only, Standard for iframes, embeds and forms with scripts stripped, or Trusted to render your code verbatim — with JavaScript, if your admin allows it.
Auto-height fits the block to its content (or set a fixed height). Publish the page and it renders for every viewer, inside a sealed sandbox.
Need help or spotted a bug? Email support@taskhooker.com.
The apps this replaces hand you a bare <textarea>. This one
behaves like the tools you write code in everywhere else.
Syntax highlighting for HTML, CSS and JavaScript, line numbers, bracket matching, undo history, and a tab per language.
The preview renders through the exact same pipeline as the published page — profile, sanitization, sandbox and all. No save-and-pray.
Render an .html file attached to the page, up to 10 MB — and still restyle it with the block's CSS and JS tabs.
Other HTML apps bolt an allowlist onto raw rendering. Here, containment is the architecture.
Strict, Standard, or Trusted — DOMPurify under the hood, per block. When something is removed, a banner says exactly what. Nothing fails silently.
A site-wide JavaScript kill-switch and a maximum-profile ceiling, in Confluence administration. Authors can go stricter than the ceiling, never looser.
Author code runs on a null origin inside a sandboxed frame within the app's own isolated frame — no access to Confluence data, cookies, or anything beyond its block.
Zero storage of page content, zero external egress, no analytics, no telemetry. Your HTML never leaves your Atlassian site — verifiably, by architecture.
Attached files are read with each viewer's own permissions. Nobody sees content they couldn't already open in Confluence.
100 KB of code per block and attached files up to 10 MB — stated up front, so you can plan around them instead of discovering them.
Free for sites with up to 10 users. Per-user pricing tapers down automatically as your site grows — 30-day free trial on every paid tier, billed through the Atlassian Marketplace.
| Users | Price per user / month |
|---|---|
| 1–10 | Free |
| 11–100 | US$0.39 |
| 101+ | Tapers down automatically — see the Marketplace listing for the full tier table |
Every paid tier includes a 30-day free trial, managed entirely through the Atlassian Marketplace — no credit card details are collected by the app itself.
An Atlassian Forge app that adds an HTML Block macro to Confluence Cloud. Authors write HTML, CSS and JavaScript in a real code editor with a live preview — or render an .html file attached to the page — and the block renders inside a sealed sandbox with configurable sanitization.
No. The app runs entirely on Atlassian infrastructure: it stores no page content, calls no external APIs, and has no analytics or telemetry. Your code is saved inside the page itself as macro configuration, like any other macro. The only stored data is two site-wide admin settings.
Three layers. First, sanitization: the default Standard profile strips all scripts and event handlers with DOMPurify, and shows a banner listing anything removed. Second, admin guardrails: a site-wide JavaScript kill-switch and a maximum-profile ceiling that authors cannot exceed. Third, a sealed double sandbox: even Trusted JavaScript runs on a null origin with no access to Confluence data, cookies, or other page content.
Legacy HTML macros give you a bare textarea and rely on URL allowlists for safety. HTML for Confluence Pages gives you a syntax-highlighted editor with a live preview, content sanitization with three profiles, admin guardrails, and a zero-egress architecture that runs entirely on Atlassian — at a fraction of the market leader's price.
Yes. Switch the block's source to Attached file and pick any .html or .htm attachment up to 10 MB. The block's CSS and JS tabs still apply, so you can restyle or script the attached markup, subject to the safety profile. Files are read with each viewer's own permissions.
100 KB of combined HTML, CSS and JavaScript per block; attached files up to 10 MB; fixed heights from 40 to 4000 px; no app-imposed limit on blocks per page.
Free for sites with up to 10 users. US$0.39 per user per month for 11–100 users, tapering down automatically for larger sites. Every paid tier includes a 30-day free trial, billed through the Atlassian Marketplace.