🧹 HTML Sanitizer
Strip dangerous HTML tags, attributes, and scripts to prevent XSS — online HTML sanitizer
About this tool
HTML Sanitizer strips dangerous tags, attributes, and protocols from HTML to prevent cross-site scripting (XSS) attacks. It removes <script>, <iframe>, event handlers like onclick/onerror, javascript: URLs in href/src, and <style> blocks. The cleaned HTML is shown side-by-side with a rendered preview so you can verify the output immediately.
Example: <script>alert('xss')</script><p>Hello</p> → <p>Hello</p> (script removed, paragraph preserved). With Strip all tags enabled the same input becomes plain text: Hello.
Useful when you accept user-generated HTML (comments, rich-text editors, forum posts) and want to allow basic formatting without exposing visitors to XSS.
FAQ
Is this as secure as a server-side HTML sanitizer? ›
This tool runs in your browser using DOMParser and attribute filtering — it is a helpful development and testing aid. For production use, always sanitize HTML on the server with a dedicated library like DOMPurify, Bleach (Python), or sanitize-html (Node.js).
What exactly gets removed? ›
Script tags, iframes, objects, embeds, event handler attributes (onclick, onerror, etc.), style attributes/ blocks (optional), and javascript:/data:/vbscript: URLs in href, src, and action attributes. Safe tags like p, div, a, img, table, ul, ol, li, b, i, em, strong are preserved.
Does it strip all HTML or just dangerous parts? ›
By default, only dangerous elements are removed. Check "Strip all tags" to extract plain text from any HTML input, removing every tag.
Can I use it to clean content from a rich-text editor? ›
Yes. Paste the HTML output from a rich-text editor (TinyMCE, Quill, Tiptap) into the input — the sanitizer strips hidden scripts, event handlers, and inline styles while keeping the safe formatting tags.
How is this different from the HTML Formatter? ›
The HTML Sanitizer removes dangerous tags and attributes to prevent XSS — it changes which elements survive. The <a href="/html-formatter">HTML Formatter</a> changes whitespace and indentation but never removes tags or attributes. Use the formatter to beautify or minify code you already trust; use this tool when you need to strip untrusted HTML.