The haxxlys run in an iframe on a separate domain to haxx.ly (similar to jsfiddle) to prevent you from hacking haxxly with haxxly.

You could use it to phish with but there is a giant banner saying this website is from haxxly and is altered. Also you can view the code yourself and flag it if it's bad.