escape‑webview

You tapped a link. That is you asking to leave the app. X, Instagram, Facebook and TikTok override you and open it in a browser they control — no sign‑in, no saved passwords, no extensions, no autofill.

This is the exit.

Source on GitHub MIT 10 KB gzipped Zero dependencies

It is running on this page right now

Checking…

Nothing is sent anywhere. Detection is a User‑Agent check that runs entirely in your browser.

Install

Point your coding agent at the repo:

Install https://github.com/pauljump/escape-webview
into this site. Follow AGENTS.md.

It finds your static directory and shared layout, copies one file, adds one line, checks your CSP, and verifies the result. Or do it by hand — copy escape-webview.js and add:

<script src="/escape-webview.js" defer
        data-auto data-name="Your Site"></script>

What actually works

Android	Escapes automatically via `intent://`. The user does nothing.
iOS	Guided, not automatic. The card teaches the host app’s own two‑tap gesture.

No iPhone auto‑escape is claimed, because none exists. Measured inside X for iPhone 12.21 on iOS 26.6, with a bogus‑scheme control to catch false positives: 11 of 11 custom‑scheme routes are blocked — googlechromes://, x-safari-https://, firefox://open-url, x-web-search://, googlechrome-x-callback://, shortcuts://, and every one of them again via a hidden iframe. window.open only yields another tab inside the same in‑app browser.

Anyone selling you an iPhone auto‑escape is relying on a bug that gets patched.

It will not spy on anyone

Your analytics are automatic: if gtag, plausible, posthog, umami, fathom or dataLayer is on the page, events go there. First‑party, your data.

Telemetry back to this project is off unless you add data-telemetry, sends no URL, path, referrer, visitor ID or cookie, and honours Do Not Track and Global Privacy Control. A tool about apps taking things from you has no business quietly taking something back.

When not to install it

If your site genuinely works fine inside an in‑app browser, don’t. Interrupting every visitor with a two‑tap chore costs more than it returns. This earns its place when sign‑in, saved passwords, extensions or payments are actually involved.