Short answerOpening a hosted HTML page is generally as safe as visiting any website: it runs in your browser's sandbox and cannot read your files. The real risk is being tricked into typing passwords or payment details. Never enter credentials on a page someone sent you as a shared link.
What a shared page can and cannot do
- Cannot: read files on your device, see your other tabs, or access your email or accounts.
- Can: show anything — including a convincing fake login form — and run JavaScript like any website.
Warning signs
- A page asking you to “sign in” to Microsoft, Google, your bank or a crypto wallet. Real services never use a shared-page subdomain for sign-in.
- Urgency: “your account will be closed”, “payment failed”.
- A download prompt for an app or document you did not expect.
How this network limits abuse
Every page belongs to a signed-in Google account. Pages that combine password fields with bank or brand names, or ask for wallet recovery phrases, are refused at upload. Executable files (.exe, .apk, .dmg and similar) cannot be hosted, and addresses that imitate brands are blocked. Free pages also show a small badge with a Report link.
Report a page
Use the Report link in the badge, or the abuse report form. Reported pages are reviewed and removed when they break the rules.