All Tools › Developer & Data › HTML Sanitizer

HTML Sanitizer

Clean untrusted HTML. Remove scripts, iframes, javascript: URLs, and event handlers.

Paste untrusted HTML

Allow links (<a>)

Allow images (<img>)

Allow tables (<table>)

Strip all attributes (keep tags only)

Sanitized Output

Preview (sandboxed): rendered in a sandboxed iframe, scripts cannot execute.

Clean HTML to remove risky markup

Displaying HTML that came from users or an external source is dangerous: a hidden script or event handler can run in your visitors' browsers. Sanitising strips those dangerous parts while keeping the safe formatting — paragraphs, links, lists — so the content still looks right. This tool cleans a block of HTML and shows you the safe result.

How to use it

Paste the HTML you want to clean.
Review the sanitised output with scripts and unsafe attributes removed.
Use the cleaned markup where you were going to display it.

Why sanitise

Preventing cross-site scripting when showing user-generated content.
Cleaning HTML pasted from an untrusted source before you reuse it.
Keeping only the safe formatting you actually want to allow.

Questions people ask

Is client-side sanitising enough on its own? Treat it as one layer. For anything you store and serve to others, sanitise and escape on the server too.

Is my HTML uploaded? No — cleaning runs in your browser.