HTML Comments
An HTML comment is a note in your code that the browser ignores completely. Visitors never see it on the page, but it stays in the source file for you and anyone else who reads the code. Comments are the place to explain why a section exists or what a tricky line does.
The syntax is short: an opening angle bracket, an exclamation mark, two dashes, then your text, then two dashes and a closing angle bracket. Everything between the markers is skipped, including tags. That last part is the trick that makes comments useful for debugging.
One warning: comments are not private. Anyone can open your page source and read every comment you left, so never store passwords, keys, or personal details there. Use comments for helpful notes, like marking where a feature will go or why a decision was made.
Commenting code out
The most practical use of a comment is hiding code without deleting it. Wrap a tag in comment markers and the browser skips it entirely. This is the fastest way to test: hide a block, look at the page, then unhide it by removing the markers. It beats deleting and retyping every time.
<!-- <p>This paragraph is hidden while I test.</p> -->What good comments say
Good comments explain why, not what. The code already shows what it does; a comment should explain why you chose to do it that way. Keep comments short and current, because a comment that describes old code misleads more than it helps.
<!-- Two-column header, shown on every page -->
<header>Site name</header>Syntax
<!-- This text is a comment. It will not display on the page. -->HTML Comments Are Public - View Source Leaks Secrets
Unlike // JS comments stripped by minifiers, <!-- TODO: API key=123 --> ships to every user via View Source and remains in Git history forever. OWASP Web Security Testing Guide explicitly flags HTML comments as Info Leakage (CWE-615). Stack Overflow #21478064 (16k views) asks 'how to hide comments' - answer: you can't, use server-side <?= /*php*/ ?> or remove at build.
<!-- BAD --><!-- internal IP 10.0.0.5 admin:password -->
<?php /* server-only */ ?>Good to know
- Comments start with <!-- and end with -->.
- The browser skips everything inside them, including tags.
- Wrap code in comments to hide it while testing.
- Never put passwords or private data in comments.