Test with:
Input HTML
Sanitized Output
Sanitized HTML will appear here
Paste your HTML, instantly detect XSS vulnerabilities, and sanitize dangerous code. Free, client-side, no data leaves your browser.
Identifies script injections, event handlers, javascript: URIs, data: URI exploits, and other cross-site scripting vectors with detailed explanations.
Removes dangerous tags and attributes while preserving safe content. Configurable options let you control what gets kept.
See exactly what changed with red/green diff highlighting. Get an instant security score for any HTML snippet.
Everything runs in your browser. No HTML is sent to any server. Your code never leaves your machine.
<script> tags, event handlers (onclick, onerror), and javascript: URLs before rendering user-generated content, preventing these attacks.<script>, <iframe>, <object>, <embed>, and <form>. It strips all on* event handlers (onclick, onload, onerror, onmouseover, etc.), javascript: URLs, and data: URLs in script contexts. Images, links, and basic formatting are preserved by default.