ETEAO
Productivity

    Search by tool name, description, or keyword. ↑↓ to move, Enter to open, Esc to close.

    SNS Embed Code Generator

    Get embed code from an X, Facebook, Instagram, or Threads URL

    Paste a link and we'll detect the platform and build the code automatically.

    About SNS Embed Code Generator

    Paste the address of a post on X (Twitter), Facebook, Instagram or Threads and this tool produces embed code for a blog or web page. It offers two methods. Script mode uses the platform’s official widget script (widgets.js, sdk.js or embed.js) to turn a placeholder element into the rendered post. Iframe mode loads the platform’s dedicated embed URL directly in an iframe. Threads has no public iframe endpoint, so it is always generated in script mode.

    The two methods look similar on screen but grant very different things to your page. This page covers that difference, what embeds mean for your visitors’ privacy, and where embed code comes from in the first place (oEmbed).

    Script mode versus iframe mode

    In script mode, <script src="https://platform.twitter.com/widgets.js"> runs inside your page with the same privileges as your own code. In principle it can read and modify your DOM. In return, it sizes the embed to the post’s real height and applies options such as dark theme or language the way the platform intends.

    Iframe mode confines the post to a window from a different origin. The platform’s code cannot touch your page’s DOM, and you add no third-party script at all. The trade-off is height. An iframe does not know how tall its content is, so the tool fills in estimates: 600 px for X, 800 px for Instagram (640 px with the caption hidden). Long posts get clipped and short ones leave empty space, so adjust the height field to fit.

    If you run a strict Content Security Policy, iframe mode is easier to live with because you only need to allow the frame source, not widen script-src. If you are embedding many posts in one long article, script mode with the loader included once (the “omit script” option on the rest) is lighter than many separate frames.

    Embeds and third-party cookies

    Either way, the post is loaded from the platform’s servers, so each visitor’s browser makes requests to x.com, facebook.com or instagram.com as soon as the page opens. No click is needed. If the visitor is signed in to that platform, third-party cookies may be sent along, which lets the platform associate that person with a visit to your page.

    What happens next depends on the browser. WebKit’s documentation states that Intelligent Tracking Prevention in Safari blocks all third-party cookies by default, with no exceptions. Chrome, by contrast, announced in 2025 that it would not go ahead with its planned third-party cookie phase-out and would instead keep offering users a choice in settings. The same embed can therefore be tracked for one visitor and not for another.

    The tool’s “do not track” option for X adds data-dnt="true" in script mode or a dnt=true parameter in iframe mode, which asks X not to use the view for personalization. It is a request, not a block; the network requests still happen. If your site uses a cookie-consent banner, decide whether embeds should wait for consent. The only approach that sends nothing to the platform is a screenshot of the post with a plain link to the original.

    Where embed code comes from: oEmbed

    When you paste a bare post URL into WordPress or a similar CMS and it turns into an embed, that is oEmbed at work. The consumer (your CMS) sends the URL to the provider’s oEmbed endpoint and gets JSON back with fields such as type, version (always 1.0), html, width and height. There are four types: photo, video, link and rich. A page can advertise its endpoint with <link rel="alternate" type="application/json+oembed">.

    The oEmbed specification recommends that consumers display rich or video HTML inside an iframe hosted from another domain, because inserting a provider’s HTML straight into your page opens the door to cross-site scripting and cookie theft. This tool’s iframe mode follows the same isolation idea. Note that the tool does not call any oEmbed API; it assembles each platform’s documented embed format locally. It therefore cannot tell you in advance whether a post has been deleted or made private. Check the result on a real page.

    Common reasons an embed shows up blank

    • The post is from a private account or has been deleted. In script mode you are left with an empty blockquote and a link.
    • An Instagram URL carries tracking parameters like ?utm_source=. The tool strips query strings and fragments and adds a trailing slash to get a clean permalink.
    • An ad blocker or tracking-protection extension blocks the widget script or the iframe domain.
    • Your CSP does not allow platform.twitter.com, connect.facebook.net or www.instagram.com.
    • The URL is from YouTube, TikTok, Vimeo or another platform this tool recognizes but does not support, so no code is generated.

    Worked examples

    An X post with do-not-track, both methods

    Input
    URL: https://x.com/jack/status/20 / do not track on / (2) iframe mode with lazy loading
    Output
    (1) <blockquote class="twitter-tweet" data-dnt="true" data-width="550"> <p lang="ko" dir="ltr"></p> <a href="https://x.com/jack/status/20"></a> </blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> (2) <iframe src="https://platform.twitter.com/embed/Tweet.html?id=20&amp;dnt=true" width="550" height="600" loading="lazy" ... title="X post"></iframe>

    In (1) an external script runs in your page and sizes the post automatically. In (2) the tool extracts only the post ID and frames it with no script, at a fixed 600 px estimate, so a long thread may be cut off. loading="lazy" defers the request until the frame nears the viewport, which also delays any cookies being sent.

    An Instagram URL with a tracking parameter

    Input
    URL: https://www.instagram.com/p/ABC123/?utm_source=x / iframe mode
    Output
    <iframe src="https://www.instagram.com/p/ABC123/embed/captioned/" width="400" height="800" ... title="Instagram post"></iframe>

    The query string was removed and embed/captioned/ appended to the clean permalink. Hiding the caption switches the path to embed/ and the default height to 640 px.

    How to use it

    1. Paste the post URL. The platform is detected from the address.
    2. Pick script or iframe mode and set options such as theme, width, alignment and hiding the caption.
    3. If the page will hold several embeds, turn on “omit script” for all but the first.
    4. Paste the code into your editor’s HTML view and check it on the live page.

    Frequently asked questions

    Is iframe mode safer?

    In the sense that the platform’s code cannot reach your page’s DOM, yes. Requests still go to the platform, so for visitor tracking the difference is small.

    Does “do not track” stop cookies being sent?

    No. data-dnt is a signal asking X not to personalize based on the view. Whether cookies are sent is decided by the visitor’s browser settings.

    Why is there no iframe option for Threads?

    Threads does not publish an iframe embed URL, so the tool uses its official embed.js script.

    My CMS strips script tags. What should I use?

    Use iframe mode, which needs no script. If iframes are stripped too, a screenshot plus a link is the fallback.

    Can I embed YouTube videos here?

    No. The tool recognizes YouTube, TikTok, Vimeo and some others but only generates code for X, Facebook, Instagram and Threads.

    Sources

    Last reviewed:

    Privacy and how data is handled

    Related tools

    Productivity