Opening an HTML file on a phone

Someone emailed you report.html. On a laptop you'd double-click it. On a phone, you get one of these:

  • Mail shows the raw markup as text.
  • A download that lands somewhere no app will open.
  • It opens, and it's blank or unstyled.

Why it's awkward on iOS

iOS Mail deliberately doesn't render .html attachments — a mail client executing markup from an arbitrary sender is a bad idea, and Apple treats it as one. The workaround that mostly works:

  1. Tap the attachment.
  2. Share → Save to Files.
  3. Open the Files app and tap the saved file. Safari renders it.

That gets you a single, self-contained page. It does not get you a real report, because a file opened this way has an opaque file:// origin:

  • fetch() and XMLHttpRequest to a neighbouring file are blocked.
  • <script type="module"> won't load — module fetches follow CORS rules even locally.

Any report that loads its results as JSON at view time — Vitest's HTML reporter is the well-known example — renders as an empty shell no matter what you do on the phone.

Why it's awkward on Android

Download the file, open the Files app, tap it, and Chrome will usually offer to render it. Usually. Plenty of Android builds have no default handler registered for local text/html and the tap simply does nothing, and the ones that do work hit the exact same file:// restrictions.

The blank-page cause you can't fix on the device

Most tools that produce "an HTML report" produce a directoryindex.html plus a sibling folder of CSS, JavaScript and JSON. Playwright, Allure, genhtml, nbconvert, Sphinx and Storybook all do.

Email one file out of that folder and every reference in it points at something that isn't there. No amount of Save-to-Files fixes a missing stylesheet. See why the report lost its CSS.

The fix: read a URL, not a file

Whoever has the report on a desktop drags the file — or the whole output folder, or a zip — into Comma and sends the link instead:

  • index.html becomes the report body, assets upload alongside it, and relative references are rewritten to the uploaded copies.
  • Scripts run inside a sandboxed iframe (allow-scripts, no allow-same-origin), so interactive reports stay interactive — on a phone too. See interactive HTML reports.

It opens in mobile Safari or Chrome like any other page. Nothing to download, nothing to save, nothing to have an app for.

If you're the one sending it

Send the link the first time. The attachment costs the recipient three steps on a laptop and usually defeats them on a phone — and the moment there are two recipients, there are two copies and no way to point at the same paragraph. See email an HTML report and stop screenshotting reports.

Is it safe to open?

Treat an .html attachment like any file from that sender — it can carry scripts, and opening it locally runs them on your device. Comma renders uploaded report HTML inside a sandboxed iframe with no same-origin access, so a script in a report can't reach your session, cookies or storage. That is a containment boundary, not a malware scanner: don't publish files from senders you don't trust.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Turn the file into a link →

Related