PleasepostMessage
Safe to usehtmlThe postMessage API sends string or structured data between windows, iframes and workers across origins, the backbone of safe cross origin messaging. It is supported everywhere; always validate the origin of every incoming message.
- Verdict
- Safe to use
- Category
- HTML features
- Browser support
- Can I Use
- Works in
- all modern browsers
Should you use postMessage in 2026?
postMessage is present in IE8 and up, but if you need robust support for cross-frame and cross-domain communication, use EasyXDM
How to use it
// sender
iframe.contentWindow.postMessage({ type: 'ping' }, 'https://example.com');
// receiver
addEventListener('message', e => {
if (e.origin !== 'https://example.com') return; // always check the origin
console.log(e.data);
});