Allow pasting in the Chrome console: what the DevTools warning means and how to clear it

When pasting is blocked, the Console logs this message in current Chrome:

Warning: Don't paste code into the DevTools Console that you don't understand or haven't reviewed yourself. This could allow attackers to steal your identity or take control of your computer. Type "allow pasting" below and press Enter to allow pasting.

Older Chrome versions phrased the last sentence as "Please type 'allow pasting' below and hit Enter". The meaning is the same.

The Chrome team explains the reasoning in How Chrome DevTools helps to defend against self-XSS attacks. Pasting is a core DevTools feature, so Chrome only blocks it for profiles that look new to DevTools. If your profile has at least 5 entries in its Console history, Chrome skips the warning. That is why people who use DevTools every day rarely see it, and why it shows up on a fresh profile or a new machine.

Most "allow pasting not working" reports come down to one of these details. DevTools compares what you type against the phrase exactly.

• Paste first. The phrase only unlocks pasting while the warning is active, so typing it before you have pasted does nothing special.
• Leave out the double quotes. "allow pasting" is a JavaScript string, so the Console prints it back and pasting stays blocked. Plain allow pasting works, and so does 'allow pasting' in single quotes.
• Watch for extra spaces, a capital letter or autocomplete adding characters. Clear the prompt and type it again if in doubt.
• If your DevTools language is not English, the phrase is translated. Type the one shown in your warning.
• Press Enter after typing. Chrome echoes the phrase in the Console and clears the prompt.

After that, pasting works in the Console for that profile.

The code editors in DevTools, such as a snippet in Sources > Snippets, have the same protection. Instead of a Console message you get a dialog with a text field. Type allow pasting into the field, confirm, then paste. Closing the dialog without typing the phrase leaves pasting blocked.

Microsoft Edge is built on Chromium and behaves the same way. Its docs cover both cases in Allow pasting into the Console and Allow pasting into the Snippet editor.

Chrome stores the "allow pasting" choice as a DevTools setting in your browser profile. You see the warning again when that setting is missing.

• You use a new Chrome profile or a new install.
• You reset DevTools with Settings > Preferences > Restore defaults and reload.
• You hit a rare bug the Chrome team mentions in its self-XSS post, where the warning keeps returning. Its suggested fix is to create a new profile.

For automated testing, start Chrome with --unsafely-disable-devtools-self-xss-warnings to skip the warnings entirely. Chrome for Testing has them turned off by default. Keep the flag out of the browser you use day to day.

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --unsafely-disable-devtools-self-xss-warnings

# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --unsafely-disable-devtools-self-xss-warnings

Self-XSS is social engineering. A scammer cannot inject a script into a site, so they ask you to run it for them. The usual pitch is "paste this into the console to unlock a feature", "claim free credits" or "verify your account". Code in the Console runs with the page's full access, as you.

• It can read anything the page can, including localStorage, sessionStorage and cookies that are not marked HttpOnly. Many apps keep login tokens there.
• It can call the site's API with your session. That means sending messages, changing settings or moving money.
• It can send what it finds to another server with a single fetch call.

Typing allow pasting is fine when you are a developer pasting code you wrote or can read. The phrase only removes a speed bump. What matters is reading every paste before you press Enter.

Paste into a Snippet when you will run the same code more than once. Open Sources > Snippets, click New snippet, paste, save, then run it with Ctrl+Enter (Cmd+Enter on a Mac). You can also open the Command Menu with Ctrl+Shift+P (Cmd+Shift+P), delete the > and type ! plus the snippet name. Saved code is easier to review than a one-off paste. The Chrome Snippets docs cover the details.

A common reason to paste is a request you copied as fetch from the Network panel. Read it before you run it:

• The URL points at the site you expect, not some other host.
• The method matches what you want. A DELETE or POST changes data on the server.
• The body holds plain JSON or form data, with no long encoded strings you cannot read.
• There is no extra code around the fetch, such as eval, atob or a second request that sends document.cookie somewhere.

If you only need the response, Copy as cURL and run it in a terminal. It runs outside the page, so it cannot read the page's storage. The command does carry your cookies and auth headers, so treat it like a password and do not paste it into chats or tickets.

Netraptor is a Chrome extension that adds a Netraptor panel to DevTools. It lists the requests of the inspected tab as soon as the panel is open. Right-click any request to replay or copy it, so you skip the copy, paste and allow pasting round trip.

• Resend runs the same request again with fetch inside the inspected page, using the page's cookies. The new request appears in the list tagged Resent.
• Edit and resend as fetch opens a form where you change the method, URL, headers and body before sending.
• Copy offers cURL (bash), cURL (cmd), PowerShell, fetch and Node.js fetch, plus Copy response and Copy all as HAR.

Resend sends only the captured request. It leaves out headers the browser sets itself, such as Cookie, Origin and User-Agent, and lets Chrome add them. It works on live traffic only, not on saved history, because it needs the page you are inspecting. Copy and Resend are in the Free plan.

If you are pasting to read a token from a request, see JWT decode in Chrome. To list every call an app makes, see how to find the API endpoints of a web app.