The HTML <script>
element is used to embed executable code or data; this is typically used to embed or refer to JavaScript code. The <script>
element can also be used with other languages, such as WebGL's GLSL shader programming language and JSON.
Content categories | Metadata content, Flow content, Phrasing content. |
---|---|
Permitted content | Dynamic script such as text/javascript . |
Tag omission | None, both the starting and ending tag are mandatory. |
Permitted parents | Any element that accepts metadata content, or any element that accepts phrasing content. |
Implicit ARIA role | No corresponding role |
Permitted ARIA roles | No role permitted |
DOM interface | HTMLScriptElement |
Attributes
This element includes the global attributes.
async
HTML5-
For classic scripts, if the
async
attribute is present, then the classic script will be fetched in parallel to parsing and evaluated as soon as it is available.For module scripts, if the
async
attribute is present then the scripts and all their dependencies will be executed in the defer queue, therefore they will get fetched in parallel to parsing and evaluated as soon as they are available.This attribute allows the elimination of parser-blocking JavaScript where the browser would have to load and evaluate scripts before continuing to parse.
defer
has a similar effect in this case.This is a boolean attribute: the presence of a boolean attribute on an element represents the true value, and the absence of the attribute represents the false value.
See Browser compatibility for notes on browser support. See also Async scripts for asm.js.
crossorigin
- Normal
script
elements pass minimal information to thewindow.onerror
for scripts which do not pass the standard CORS checks. To allow error logging for sites which use a separate domain for static media, use this attribute. See CORS settings attributes for a more descriptive explanation of its valid arguments. defer
-
This Boolean attribute is set to indicate to a browser that the script is meant to be executed after the document has been parsed, but before firing
DOMContentLoaded
.Scripts with the
defer
attribute will prevent theDOMContentLoaded
event from firing until the script has loaded and finished evaluating.This attribute must not be used if the
src
attribute is absent (i.e. for inline scripts), in this case it would have no effect.The
defer
attribute has no effect on module scripts — they defer by default.Scripts with the
defer
attribute will execute in the order in which they appear in the document.This attribute allows the elimination of parser-blocking JavaScript where the browser would have to load and evaluate scripts before continuing to parse.
async
has a similar effect in this case. integrity
- This attribute contains inline metadata that a user agent can use to verify that a fetched resource has been delivered free of unexpected manipulation. See Subresource Integrity.
nomodule
- This Boolean attribute is set to indicate that the script should not be executed in browsers that support ES2015 modules — in effect, this can be used to serve fallback scripts to older browsers that do not support modular JavaScript code.
nonce
- A cryptographic nonce (number used once) to whitelist scripts in a script-src Content-Security-Policy. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial.
referrerpolicy
- Indicates which referrer to send when fetching the script, or resources fetched by the script:
no-referrer
: TheReferer
header will not be sent.no-referrer-when-downgrade
(default): TheReferer
header will not be sent to origins without TLS (HTTPS).origin
: The sent referrer will be limited to the origin of the referring page: its scheme, host, and port.origin-when-cross-origin
: The referrer sent to other origins will be limited to the scheme, the host, and the port. Navigations on the same origin will still include the path.same-origin
: A referrer will be sent for same origin, but cross-origin requests will contain no referrer information.strict-origin
: Only send the origin of the document as the referrer when the protocol security level stays the same (e.g. HTTPS→HTTPS), but don't send it to a less secure destination (e.g. HTTPS→HTTP).strict-origin-when-cross-origin
: Send a full URL when performing a same-origin request, but only send the origin when the protocol security level stays the same (e.g.HTTPS→HTTPS), and send no header to a less secure destination (e.g. HTTPS→HTTP).unsafe-url
: The referrer will include the origin and the path (but not the fragment, password, or username). This value is unsafe, because it leaks origins and paths from TLS-protected resources to insecure origins.
Note: An empty string value (
""
) is both the default value, and a fallback value ifreferrerpolicy
is not supported. Ifreferrerpolicy
is not explicitly specified on the<script>
element, it will adopt a higher-level referrer policy, i.e. one set on the whole document or domain. If a higher-level policy is not available, the empty string is treated as being equivalent tono-referrer-when-downgrade
. src
-
This attribute specifies the URI of an external script; this can be used as an alternative to embedding a script directly within a document.
type
-
This attribute indicates the type of script represented. The value of this attribute will be in one of the following categories:
- Omitted or a JavaScript MIME type: This indicates the script is JavaScript. The HTML5 specification urges authors to omit the attribute rather than provide a redundant MIME type. In earlier browsers, this identified the scripting language of the embedded or imported (via the
src
attribute) code. JavaScript MIME types are listed in the specification. module
: Causes the code to be treated as a JavaScript module. The processing of the script contents is not affected by thecharset
anddefer
attributes. For information on usingmodule
, see our JavaScript modules guide. Unlike classic scripts, module scripts require the use of the CORS protocol for cross-origin fetching.- Any other value: The embedded content is treated as a data block which won't be processed by the browser. Developers must use a valid MIME type that is not a JavaScript MIME type to denote data blocks. The
src
attribute will be ignored.
- Omitted or a JavaScript MIME type: This indicates the script is JavaScript. The HTML5 specification urges authors to omit the attribute rather than provide a redundant MIME type. In earlier browsers, this identified the scripting language of the embedded or imported (via the
Deprecated attributes
charset
- If present, its value must be an ASCII case-insensitive match for "
utf-8
". It’s unnecessary to specify thecharset
attribute, because documents must use UTF-8, and thescript
element inherits its character encoding from the document. language
- Like the
type
attribute, this attribute identifies the scripting language in use. Unlike thetype
attribute, however, this attribute’s possible values were never standardized. Thetype
attribute should be used instead.
Notes
Scripts without async
, defer
or type="module"
attributes, as well as inline scripts, are fetched and executed immediately, before the browser continues to parse the page.
The script should be served with the text/javascript
MIME type, but browsers are lenient and only block them if the script is served with an image type (image/*
); a video type (video/*
); an audio (audio/*
) type; or text/csv
. If the script is blocked, an error
is sent to the element, if not a load
event is sent.
Examples
Basic usage
These examples show how to import (an external) script using the <script>
element.
<script src="javascript.js"></script>
And the following examples show how to put (an inline) script inside the <script>
element.
<script> alert("Hello World!"); </script>
Module fallback
Browsers that support the module
value for the type
attribute ignore any script with a nomodule
attribute. That enables you to use module scripts while also providing nomodule
-marked fallback scripts for non-supporting browsers.
<script type="module" src="main.js"></script> <script nomodule src="fallback.js"></script>
Embedding data in HTML
You can also use the <script>
element to embed data in HTML with server-side rendering by specifying a valid non-JavaScript MIME type in the type
attribute.
<!-- Generated by the server --> <script id="data" type="application/json">{"userId":1234,"userName":"John Doe","memberSince":"2000-01-01T00:00:00.000Z"}</script> <!-- Static --> <script> const userInfo = JSON.parse(document.getElementById("data").text); console.log("User information: %o", userInfo); </script>
Specifications
Specification | Status | Comments |
---|---|---|
HTML Living Standard The definition of '<script>' in that specification. |
Living Standard | Removed the charset attribute |
HTML5 The definition of '<script>' in that specification. |
Recommendation | |
HTML 4.01 Specification The definition of '<script>' in that specification. |
Recommendation |
Browser compatibility
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
script | Chrome Full support 1 | Edge Full support 12 | Firefox
Full support
1
| IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
async | Chrome Full support 1 | Edge Full support 12 | Firefox Full support 1 | IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
crossorigin | Chrome Full support 30 | Edge Full support ≤18 | Firefox Full support 13 | IE No support No | Opera Full support 12 | Safari
Full support
Yes
| WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 14 | Opera Android ? | Safari iOS ? | Samsung Internet Android Full support Yes |
defer | Chrome
Full support
Yes
| Edge Full support 12 | Firefox
Full support
3.5
| IE
Full support
10
| Opera
Full support
Yes
| Safari Full support Yes | WebView Android
Full support
Yes
| Chrome Android
Full support
Yes
| Firefox Android Full support 4 | Opera Android
Full support
Yes
| Safari iOS Full support Yes | Samsung Internet Android
Full support
Yes
|
integrity | Chrome Full support 45 | Edge Partial support 17 | Firefox Full support 43 | IE No support No | Opera Full support Yes | Safari Full support Yes | WebView Android Full support 45 | Chrome Android Full support 45 | Firefox Android Full support 43 | Opera Android ? | Safari iOS No support No | Samsung Internet Android Full support 5.0 |
language | Chrome Full support 1 | Edge Full support 12 | Firefox Full support 1 | IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
nomodule | Chrome Full support 61 | Edge Full support 16 | Firefox
Full support
60
| IE No support No | Opera Full support 48 | Safari Full support 11 | WebView Android Full support 61 | Chrome Android Full support 61 | Firefox Android
Full support
60
| Opera Android Full support 45 | Safari iOS Full support 11 | Samsung Internet Android Full support 8.0 |
referrerPolicy | Chrome Full support 70 | Edge Full support ≤79 | Firefox Full support 65 | IE No support No | Opera Full support Yes | Safari No support No | WebView Android Full support 70 | Chrome Android Full support 70 | Firefox Android Full support 65 | Opera Android ? | Safari iOS No support No | Samsung Internet Android Full support 10.0 |
src | Chrome Full support 1 | Edge Full support 12 | Firefox Full support 1 | IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
text | Chrome Full support 1 | Edge Full support 12 | Firefox Full support 1 | IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
type | Chrome Full support 1 | Edge Full support 12 | Firefox Full support 1 | IE Full support Yes | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
type.module | Chrome Full support 61 | Edge Full support 16 | Firefox
Full support
60
| IE No support No | Opera Full support 48 | Safari Full support 10.1 | WebView Android Full support 61 | Chrome Android Full support 61 | Firefox Android
Full support
60
| Opera Android Full support 45 | Safari iOS Full support 10.3 | Samsung Internet Android Full support 8.0 |
type : The version parameter of the type attribute | Chrome No support No | Edge No support No | Firefox No support ? — 59 | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support ? — 59 | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
Legend
- Full support
- Full support
- Partial support
- Partial support
- No support
- No support
- Compatibility unknown
- Compatibility unknown
- Experimental. Expect behavior to change in the future.
- Experimental. Expect behavior to change in the future.
- Non-standard. Expect poor cross-browser support.
- Non-standard. Expect poor cross-browser support.
- Deprecated. Not for use in new websites.
- Deprecated. Not for use in new websites.
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.
Compatibility notes
In older browsers that don't support the async
attribute, parser-inserted scripts block the parser; script-inserted scripts execute asynchronously in IE and WebKit, but synchronously in Opera and pre-4 Firefox. In Firefox 4, the async
DOM property defaults to true
for script-created scripts, so the default behaviour matches the behaviour of IE and WebKit.
To request script-inserted external scripts be executed in the insertion order in browsers where the document.createElement("script").async
evaluates to true
(such as Firefox 4), set async="false"
on the scripts you want to maintain order.
Never call document.write()
from an async script. In Firefox 3.6, calling document.write()
has an unpredictable effect. In Firefox 4, calling document.write()
from an async script has no effect (other than printing a warning to the error console).