TrustedHTML: toJSON() method
Baseline 2026
Newly available
Since February 2026, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.
Note: This feature is available in Web Workers.
The toJSON() method of the TrustedHTML interface returns a string representing the TrustedHTML object. This is the same string that TrustedHTML.toString() returns.
The method is automatically called by JSON.stringify() when a TrustedHTML object is encountered during JSON serialization. The serialized value can then be converted back using the TrustedTypePolicy.createHTML() method within the reviver of JSON.parse(), which runs the policy's transformation on it again.
Syntax
toJSON()
Parameters
None.
Return value
A string.
Examples
Calling toJSON() directly
This example creates a TrustedHTML object. Calling toJSON() directly returns its stored string value.
const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
createHTML: (string) => string.replace(/</g, "<"),
});
const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");
const json = escaped.toJSON();
console.log(json); // Same value as escaped.toString()
console.log(typeof json); // "string"
Serializing to a JSON string
The TrustedHTML object from the previous example is serialized using JSON.stringify(), which calls the toJSON() method automatically.
console.log(JSON.stringify(escaped));
This would log the following JSON string, including the surrounding double quotes, which are part of the string's content:
"<img src=x onerror=alert(1)>"
Specifications
| Specification |
|---|
| Trusted Types # dom-trustedhtml-tojson |