HTML Tag Filter
Use the local DOMPurify to clean HTML under three fixed presets: strict rich text, common HTML, or text only; deleted elements and attributes are also reported.
How to use the HTML tag to filter
HTML Only cleans and previews in the current browser; nothing is uploaded, and external resources are not loaded automatically.
Enter content to clean HTML
Paste snippets from untrusted sources, and choose strict rich text, commonly HTML, or text-only presets based on the final use.
Check cleaning report
After execution, check the deleted elements and attributes; the report lists only deleted items and does not assess attack intent or the URL risk level.
Copy and review in context
Copy the sanitized result, and continue applying the appropriate protection based on its final insertion into HTML, attributes, or other context.
Limitations and Notes
- Sanitizer can only protect the HTML contexts covered by its design; subsequent modifications to the result may reintroduce risks.
- The page provides only three fixed presets and does not support a custom allowlist; any need to loosen the rules should be reviewed separately in production code.
- The deletion report is intended to support review and cannot serve as proof for security decisions or attack detection.
FAQ
Can the cleaned content be written directly to innerHTML?
Applicable only when the final context matches the policy and subsequent code no longer modifies the result; production use still requires a security review.
Why were some styles or links removed?
The corresponding preset actively restricts content that may load resources, execute behavior, or break through page style boundaries.