Sample HTML, CSS and JS files — free download
Web and interchange formats: a complete HTML page, a stylesheet, a script, Markdown, TSV, an iCalendar event and a vCard contact — each small, valid and generated from source.
8 ready-made web test files
| File | Size | What it catches | |
|---|---|---|---|
| data.tsv | 80 bytes | Importers that treat TSV as "CSV with commas" and split on the wrong delimiter, or that collapse runs of whitespace and merge the tab-separated columns. | download |
| contact.vcf | 137 bytes | Contact import. Includes a non-ASCII organisation name to catch importers that assume ASCII, and the CRLF line endings vCard requires. | download |
| script.js | 280 bytes | JS parsers, bundlers and transpilers. Uses ES2017+ features so it catches tooling stuck on older syntax. | download |
| styles.css | 357 bytes | CSS parsers, minifiers and linters. Exercises custom properties and @media/@keyframes at-rules. | download |
| calendar.ics | 374 bytes | Calendar import (Google, Outlook, Apple). CRLF line endings are mandatory in iCalendar, and this file uses them - a good check for code that normalises newlines and breaks the format. | download |
| page.html | 413 bytes | HTML preview, sanitiser baselines and "render to PDF" pipelines. This one is inert and must survive sanitisation intact - contrast with the XSS payloads in the security set. | download |
| README.md | 413 bytes | Markdown renderers and converters. A fenced code block that itself contains Markdown catches renderers that fail to treat fenced content as literal. | download |
| html-xss-payloads.html | 855 bytes | HTML sanitisers, rich-text editors and preview renderers. Feed this through your sanitiser and diff the output: anything executable that survives is a finding. | download |
Every file is generated from source — no third-party copyright — and each has its own page with a published SHA-256 you can verify after download.
Questions
Where can I download a sample HTML file?
The HTML page below is a complete, valid document — useful for testing renderers, converters and upload filters.
Do you have a sample .ics or .vcf file?
Yes, both. The iCalendar file contains a timed event and an all-day marker; the vCard is a single fictional contact using reserved example.test and 555-01xx values.