Chrome won't let you paste into the console? Type "allow pasting" (no quotes)

TL;DR: Paste once so the warning shows up. Then type allow pasting in the Console prompt, without quotes, and press Enter. Paste again. Chrome remembers the choice for that profile.

I set up a fresh Chrome profile last week, pasted a snippet into the Console, and got this instead of my code:

Warning: Don't paste code into the DevTools Console that you don't understand or haven't reviewed yourself. This could allow attackers to steal your identity or take control of your computer. Type "allow pasting" below and press Enter to allow pasting.

If you landed here from Google with that exact text in the search box, here is the short version and the parts that trip people up.

The fix

1. Open the Console (Ctrl+Shift+J, or Cmd+Option+J on a Mac).
2. Paste your code. Chrome blocks it and logs the warning.
3. Type allow pasting and press Enter.
4. Paste again. It lands in the prompt this time.

In the Sources panel (for example a snippet under Sources > Snippets) you get a dialog with a text field instead of a Console message. Type the same phrase there and confirm.

Why "allow pasting" sometimes doesn't work

I looked at the DevTools source to see what it checks. It compares the prompt text against the phrase exactly, and only while the warning is active. So:

• Paste first. Typing the phrase before the warning appears does nothing.
• No double quotes. The warning shows the phrase in double quotes, but "allow pasting" is just a JS string. The Console echoes it and you are still blocked. Plain allow pasting works, and so does 'allow pasting' with single quotes.
• No extra spaces or capitals. Watch for autocomplete adding things.
• Non-English DevTools uses a translated phrase. Type the one in your warning.

Why you don't see it on your main profile

Chrome only shows the warning to profiles that look new to DevTools. If your Console history has at least 5 entries, it skips the warning entirely. The Chrome team wrote this up in How Chrome DevTools helps to defend against self-XSS attacks.

It comes back when the stored setting is gone:

• a new Chrome profile or a fresh install
• Settings > Preferences > Restore defaults and reload
• a rare bug mentioned in the Chrome post, where a new profile is the suggested fix

For CI and automation, launch Chrome with:

--unsafely-disable-devtools-self-xss-warnings

Chrome for Testing already has the warnings off. Edge is Chromium, so it behaves the same and takes the same flag.

The reason it exists: self-XSS

Self-XSS is the "paste this in your console to get free credits" scam. Whatever you paste runs as you on that site. It can:

• read localStorage, sessionStorage and any cookie that isn't HttpOnly, which is where a lot of apps keep tokens
• call the site's API with your session
• fetch all of it off to someone else's server

For us the phrase is a one-time speed bump. The habit worth keeping is reading every paste before you hit Enter.

Safer habits for code you copied

Use a Snippet for anything you run twice. Sources > Snippets > New snippet, paste, save, then Ctrl+Enter / Cmd+Enter. You can also run it from the Command Menu (Ctrl+Shift+P, delete the >, type !snippet-name).

Read a copied fetch before running it. Check that:

• the URL is the host you expect
• the method is what you want (POST and DELETE change data)
• the body is readable JSON or form data
• nothing extra wraps the call, like eval, atob, or a second fetch that ships document.cookie somewhere

Prefer cURL in a terminal if you only need the response. It runs outside the page, so it can't touch page storage. It still carries your cookies and auth headers, so don't drop it into Slack.

Skipping the paste entirely

Half the time I'm pasting because I copied a request as fetch and want to replay it with a tweak. I use Netraptor for that now (disclosure: it's ours). It's a DevTools panel where you right-click a request and pick Resend, or Edit and resend as fetch to change the method, URL, headers or body first. It runs the request with fetch inside the inspected page using the page's cookies, and the result shows up tagged Resent. The same menu copies as cURL (bash/cmd), PowerShell, fetch or Node.js fetch. It only works on live traffic, since it needs the page you're inspecting.

Full guide, with the Sources dialog and FAQ: Allow pasting in the Chrome console