Is there a limit to the length of HTML attributes?

HTML 4

From an HTML 4 perspective, attributes are an SGML construct. Their limits are defined in the SGML Declaration of HTML 4:

         QUANTITY SGMLREF
                  ATTCNT   60      -- increased --
                  ATTSPLEN 65536   -- These are the largest values --
                  LITLEN   65536   -- permitted in the declaration --
                  NAMELEN  65536   -- Avoid fixed limits in actual --
                  PILEN    65536   -- implementations of HTML UA's --
                  TAGLVL   100
                  TAGLEN   65536
                  GRPGTCNT 150
                  GRPCNT   64

The value in question here is "ATTSPLEN" which would be the limit on an element's attribute specification list (which should be the total size of all attributes for that element). The note above mentions that fixed limits should be avoided, however, so it's likely that there is no real limit other than available memory in most implementations.

HTML 5

It would seem that HTML 5 has no limits on the length of attribute values.

As the spec says, "This version of HTML thus returns to a non-SGML basis."

Later on, when describing how to parse HTML 5, the following passage appears (emphasis added):

The algorithm described below places no limit on the depth of the DOM tree generated, or on the length of tag names, attribute names, attribute values, text nodes, etc. While implementors are encouraged to avoid arbitrary limits, it is recognized that practical concerns will likely force user agents to impose nesting depth constraints.

Therefore, (theoretically) there is no limit to the length/size of HTML 5 attributes.

I've just written a test (Note! see update below) which puts a string of length 10 million into an attribute and then retrieves it again, and it works fine (Firefox 3.5.2 & Internet Explorer 7)

50 million makes the browser hang with the "This script is taking a long time to complete" message.

Update: I've fixed the script: it previously set the innerHTML to a long string and now it's setting a data attribute. https://output.jsbin.com/wikulamuni It works for me with length 100 million. YMMV.

el.setAttribute('data-test', <<a really long string>>)

From HTML5 syntax doc

9.1.2.3 Attributes

Attributes for an element are expressed inside the element's start tag.

Attributes have a name and a value. Attribute names must consist of one or more characters other than the space characters, U+0000 NULL, U+0022 QUOTATION MARK ("), U+0027 APOSTROPHE ('), U+003E GREATER-THAN SIGN (>), U+002F SOLIDUS (/), and U+003D EQUALS SIGN (=) characters, the control characters, and any characters that are not defined by Unicode. In the HTML syntax, attribute names may be written with any mix of lower- and uppercase letters that are an ASCII case-insensitive match for the attribute's name.

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand.

Attributes can be specified in four different ways:

1. Empty attribute syntax

2. Unquoted attribute value syntax

3. Single-quoted attribute value syntax

4. Double-quoted attribute value syntax

Here there hasn't mentioned a limit on the size of the attribute value. So I think there should be none.

You can also validate your document against the

HTML5 Validator(Highly Experimental)

I really don't think there is any limit. I know now you can do

<a onclick=" //...insert 100KB of javascript code here">

and it works fine. Albeit a little unreadable.