A specific snapshot
A production URL containing a full commit identifier uses long-lived caching. Publish a new commit URL when you release an update.
THE FIELD GUIDE
From your first preview to a pinned release: what to use, what to expect, and what to check when a file will not load.
01 / GET STARTED
Copy its file-view or raw URL from one of the supported hosts. A repository homepage is not a file URL. Private repositories and access tokens are not supported.
Paste it into the converter and select Create links. For GitHub branches and tags, the converter asks GitHub for the corresponding full commit. For a Gist with several files, choose the file you need.
Use Development while iterating, or a full-commit Production URL when publishing. Open the link and check it before embedding. Creating a URL does not prove that the source file exists or is accessible.
02 / PICK A VERSION
A production URL containing a full commit identifier uses long-lived caching. Publish a new commit URL when you release an update.
A branch URL can follow new commits, with a short cache. A Development URL with a commit is still fixed to that commit; the label does not make it a live branch.
A tag is not treated as immutable. Tags, branches and short hashes use a short cache even on a production hostname. Automatic commit resolution currently applies to GitHub; for other hosts, copy a full-commit raw permalink from the host.
Query parameters are removed from source requests and cache identity. Adding ?v=2 does not refresh a file, and ?min=1 does not minify it. CDN caching is not permanent storage.
Browser navigation to active documents such as HTML has a separate confirmation flow and private/no-store browser caching. Do not assume that a production HTML page behaves like a long-cached script.
03 / SOURCE HOSTS
Use these URL shapes as references. Replace the example repository and filename with a real public file.
| Platform | Example source format |
|---|---|
| GitHub | github.com/owner/repo/blob/main/file.js |
| Gist | gist.github.com/owner/gist-idA page or an individual raw-file URL |
| GitLab | gitlab.com/group/project/-/blob/main/file.css |
| Bitbucket | bitbucket.org/owner/repo/src/main/file.js |
| Gitea | gitea.com/owner/repo/src/branch/main/file.js |
| Codeberg | codeberg.org/owner/repo/src/branch/main/file.js |
GitLab nested groups work best with the explicit /-/raw/ or /-/blob/ separator. For GitHub refs containing slashes, use a full commit permalink or explicitly encode the slash inside the ref as %2F. The converter will not guess an ambiguous branch.
Only the listed public hosts are supported, not arbitrary self-hosted installations. Login pages, LFS/object-storage redirects and redirects outside the reviewed host list may be rejected.
04 / USE THE FILE
After creating links, expand Put it in your project. Choose Production or Development and copy the generated snippet. JavaScript receives a script tag, .mjs a module script tag, and CSS a stylesheet link. Other files receive a regular link.
<script src="YOUR_PRODUCTION_URL"></script>For a full-commit production script or stylesheet, select Generate SRI. Your browser downloads that source file and calculates a SHA-384 hash, then adds integrity and crossorigin="anonymous" to the snippet. The file must permit browser cross-origin access and be at most 10 MiB.
SRI checks bytes, not safety. It is not a malware scan or an endorsement of the dependency. A denied CORS request or an unreachable source can prevent generation without preventing URL conversion. After generating the hash, use the separate Copy button.
Clipboard and hashing features require browser support and a secure context. When copying is blocked, the URL or code remains selectable for manual copying.
05 / HTML PREVIEWS
Opening an HTML page in a browser shows a confirmation before displaying the repository author's content. After confirmation, a secure cookie remembers your choice for that repository on that hostname for 24 hours. Active SVG/XML documents also use this protection.
The source HTML is not sanitized. Never enter passwords, payment details or other sensitive information on an untrusted preview. A confirmation is not a security review. Read the safety notes.
Relative paths normally continue to resolve from the repository file. Root-relative paths such as /assets/app.js point to the service root, not your repository. HTML and CSS are not rewritten; missing SPA routes are not generated. Directory URLs ending in / request index.html.
06 / WITHOUT THE CONVERTER
On this deployment, path-based links let you use the current hostname without configuring separate platform subdomains:
https://YOUR_HOST/_/gh/dev/OWNER/REPO/REF/FILE
https://YOUR_HOST/_/gh/prod/OWNER/REPO/FULL_COMMIT/FILEReplace YOUR_HOST with this deployment's hostname. Other platform identifiers are gist, gl, bb, gt and cb; keep that platform's raw path after the mode. Formal rawgit.net links use their configured platform subdomains, and legacy root-domain GitHub links remain supported.
07 / WHEN SOMETHING FAILS
GitHub may be rate-limiting the browser, or the ref could be ambiguous. The development link remains available. Copy a full commit permalink from GitHub and try again. Non-GitHub hosts do not receive automatic commit lookup.
A commit URL is a snapshot and should not change. Publish a new commit URL. Branches and tags use short caching, but changes are not necessarily instant. A query string will not clear the cache, and clearing edge caches cannot withdraw files already cached by browsers.
Extensions outside the proxy's MIME map are deliberately redirected to the original raw source. This includes common PNG and JPEG images. The converter does not claim to mirror every kind of file.
Open the original raw URL. Check repository visibility, ref, filename and letter case. The host may require login, rate-limit requests or redirect to an unsupported storage host. A private file cannot be made public by changing its URL here.
Use HTTPS, allow cookies, and check that you stayed on the same hostname and repository. Blocking third-party cookies can affect embedded previews. Development over plain local HTTP does not reproduce secure-cookie behavior.
Correct: it delivers individual public files with suitable response headers. It does not install packages, bundle dependencies, rewrite imports, compile TypeScript or provide an application backend.
Have a file in mind?
Create your links