What is the difference between Strict, Moderate and Permissive?

Red comes back as Red at Strict and Moderate and unchanged at Permissive. is removed at Strict and kept at Moderate and Permissive. Kept becomes Kept at Strict and Moderate, because section is not on their list but its content is kept.

Does sanitizing HTML stop XSS?

It removes the usual ways markup runs code, but it is one layer. The OWASP XSS cheat sheet says to sanitize only where people must write HTML, to use output encoding when text should be shown exactly as typed, and to treat a Content Security Policy as an extra layer, not the main defense. Changing the HTML after sanitizing it can undo the cleaning, so sanitize last.

Why did my links lose target="_blank"?

Targets are removed unless Keep link targets is ticked. With it ticked, Site keeps its target and gets rel="noopener noreferrer". A link to another site keeps its href either way.

Why were my data- attributes removed?

DOMPurify allows data- attributes by default, and this tool turns that off at every level: x becomes x . They are not listed under Removed.

Can I allow or remove my own tags and attributes?

Yes, under Advanced: custom tag and attribute rules, with names separated by commas or spaces. They start from the chosen level: Also allow tags details, summary keeps More … at Strict, which otherwise keeps only the text. Also remove tags takes a tag out and keeps its text, and Also remove attributes drops a name such as class everywhere. Adding style to the kept attributes turns off the style removal. script, style, iframe, object, embed and form, event handlers such as onclick, and javascript: links stay blocked, and the page lists any name it ignored.

Is the HTML uploaded anywhere?

No request is made with it. DOMParser and DOMPurify clean it in this browser tab, and the input is not saved, so it is gone when you close or reload the page.

HTML Sanitizer

Sanitize pasted HTML at Strict, Moderate or Permissive level: scripts, event handlers and javascript: links are removed, and the tool lists what it took out. How it works

Raw HTML Input

0 / 50,000 characters

Sanitized Output

The sanitized HTML appears here after you press Sanitize

Sanitization Level

Keep link targets (new tab)Preserve Comments

Strict and Moderate remove tags outside their list but keep the text inside them. Script, style, iframe, object, embed and form are removed with everything inside. Links to other sites always stay. Keep link targets keeps target attributes such as target="_blank" and adds rel="noopener noreferrer"; Preserve Comments keeps HTML comments.

Advanced: custom tag and attribute rules

Also allow tags

Also remove tags (keep their text)

Also keep attributes

Also remove attributes

Separate names with commas or spaces. The rules start from the chosen level. Script, style, iframe, object, embed and form can never be allowed, and event handler attributes (onclick and the like) are always removed. Links and image addresses with a script scheme stay blocked.

About the HTML Sanitizer

At every level this HTML sanitizer removes attributes that start with on (onclick, onerror), the script, style, iframe, object, embed and form elements with everything inside them, and turns javascript: links into #. The level only decides which harmless tags stay: Strict keeps text formatting, lists, tables and links, Moderate adds images, video and audio, and Permissive keeps what DOMPurify allows by default, including SVG and inline style attributes.

How to use this tool

Paste the HTML into Raw HTML Input. Up to 50,000 characters are read; anything longer is cut, with a warning.
Pick Strict, Moderate or Permissive, and tick Keep link targets or Preserve Comments if the output needs them. Open Advanced to allow or remove extra tags and attributes.
Press Sanitize, read the Removed list and the character count, then copy the output.

Frequently asked questions

What is the difference between Strict, Moderate and Permissive?: <p style="color:red">Red</p> comes back as <p>Red</p> at Strict and Moderate and unchanged at Permissive. <video src="v.mp4" controls></video> is removed at Strict and kept at Moderate and Permissive. <section><p>Kept</p></section> becomes <p>Kept</p> at Strict and Moderate, because section is not on their list but its content is kept.
Does sanitizing HTML stop XSS?: It removes the usual ways markup runs code, but it is one layer. The OWASP XSS cheat sheet says to sanitize only where people must write HTML, to use output encoding when text should be shown exactly as typed, and to treat a Content Security Policy as an extra layer, not the main defense. Changing the HTML after sanitizing it can undo the cleaning, so sanitize last.
Why did my links lose target="_blank"?: Targets are removed unless Keep link targets is ticked. With it ticked, <a href="https://example.com" target="_blank">Site</a> keeps its target and gets rel="noopener noreferrer". A link to another site keeps its href either way.
Why were my data- attributes removed?: DOMPurify allows data- attributes by default, and this tool turns that off at every level: <p data-id="7">x</p> becomes <p>x</p>. They are not listed under Removed.
Can I allow or remove my own tags and attributes?: Yes, under Advanced: custom tag and attribute rules, with names separated by commas or spaces. They start from the chosen level: Also allow tags details, summary keeps <details><summary>More</summary>…</details> at Strict, which otherwise keeps only the text. Also remove tags takes a tag out and keeps its text, and Also remove attributes drops a name such as class everywhere. Adding style to the kept attributes turns off the style removal. script, style, iframe, object, embed and form, event handlers such as onclick, and javascript: links stay blocked, and the page lists any name it ignored.
Is the HTML uploaded anywhere?: No request is made with it. DOMParser and DOMPurify clean it in this browser tab, and the input is not saved, so it is gone when you close or reload the page.

When to sanitize pasted HTML

Run it on HTML you did not write before it goes into a CMS field, an email template, a help-desk reply or a page you will render: markup copied from a website, a rich-text export, or a snippet a user submitted. Choose a level, press Sanitize, and the panel lists what was taken out along with the character count before and after.

This input:

<p onclick='evil()'>Hi <b>there</b></p><script>alert(1)</script><a href='javascript:alert(1)'>x</a><img src='a.png' onerror='x()'>

comes back at Strict as <p>Hi <b>there</b></p><a href="#">x</a>. The click handler, the script and the image are gone, and the javascript: link now points to #. At Moderate the image stays, as <img src="a.png"> without its onerror.

Two passes: the tool's rules, then DOMPurify

The HTML is parsed with the browser's DOMParser and walked node by node. Attributes whose names start with on are removed (and inline style at Strict and Moderate), a link whose href begins with javascript: is rewritten to #, and script, style, iframe, object, embed and form are dropped with everything inside them. The result then passes through DOMPurify 3 with data attributes disallowed.

Strict keeps paragraphs, headings, lists, tables, links, div, span, br, hr, pre, blockquote and inline formatting such as b, em and code.
Moderate adds img, video and audio.
Permissive leaves the tag list to DOMPurify's defaults, so section, svg and style attributes survive.

At Moderate and Permissive an img without a src is removed. At Strict and Moderate a tag outside the list is removed and its content kept: <section><p>Kept</p></section> becomes <p>Kept</p>.

Preserve Comments keeps HTML comments, and Keep link targets keeps target and adds rel="noopener noreferrer".

Advanced: custom tag and attribute rules start from the chosen level. Also allow tags with details, summary keeps a collapsible section at Strict; Also remove tags drops a tag and keeps its text; the attribute boxes keep or remove names such as class. Keeping style turns off the style removal. No option can allow the six dropped tags, an on handler or a javascript: link.

Related Tools

View all tools

Dev

HTML Entity Encoder

Encode text to HTML entities (& < > " ') or decode any of the 2,231 named references in the HTML standard and numeric ones such as é.

Dev

HTML Minifier

Paste HTML to drop comments and collapse whitespace. The space between inline elements stays, pre and textarea are kept, and inline CSS and JS can be minified.

Dev

Markdown to HTML

Convert Markdown to HTML with GitHub tables, task lists and strikethrough. Raw HTML shows as text except 17 plain tags; javascript: links become text.

Dev

Password Generator

Generate a random password of 8 to 128 characters from uppercase, lowercase, numbers and symbols, and see its entropy in bits. Can skip look-alike characters.

Dev

SQL Query Formatter

Format SQL for Standard SQL, PostgreSQL, MySQL, SQLite or SQL Server, with keywords kept, upper-cased or lower-cased and 2-space, 4-space or tab indents.

Dev

Regex Tester

Test a JavaScript regular expression on your own text: every match with its numbered and named groups and start and end positions, flag switches and replace.