# HTML Sanitizer

Sanitize pasted HTML into safe allowlisted markup or plain text by removing scripts, event handlers, unsafe URLs, and risky tags locally in your browser.

## Run it

- **CLI:** `gizza tool html-sanitizer '<p onclick="alert(1)">Hello <a href="javascript:alert(1)">world</a></p><script>steal()</script>'`
- **Web:** https://gizza.ai/tools/html-sanitizer/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/html-sanitizer/tool.json

## Inputs

- `html` — HTML to sanitize _(field)_
- `mode` — Output mode _(field)_
- `allow_links` — Keep safe links and URL attributes _(field)_
- `allow_images` — Keep safe image tags _(field)_
- `allow_styles` — Keep safe inline style attributes _(field)_
- `keep_classes` — Keep class and id attributes _(field)_
- `keep_comments` — Keep HTML comments _(field)_

## Output

- Sanitized output (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `html` — HTML to sanitize
- `mode` — Output mode
- `allow_links` — Keep safe links and URL attributes
- `allow_images` — Keep safe image tags
- `allow_styles` — Keep safe inline style attributes
- `keep_classes` — Keep class and id attributes
- `keep_comments` — Keep HTML comments

Example: `https://gizza.ai/tools/html-sanitizer/?html=%3Cp%20onclick%3D%22alert%281%29%22%3EHello%20%3Ca%20href%3D%22javascript%3Aalert%281%29%22%3Eworld%3C%2Fa%3E%3C%2Fp%3E%3Cscript%3Esteal%28%29%3C%2Fscript%3E&mode=safe-html&allow_links=true&allow_images=true&allow_styles=true&keep_classes=true&keep_comments=true`

---

## About this tool

HTML Sanitizer removes active and risky markup from pasted HTML while preserving useful document structure. Use it when content comes from a WYSIWYG editor, email, a CMS field, an import script, or a scrape and you need either safe HTML markup or clean visible text.

The sanitizer uses an allowlist: common formatting, headings, lists, tables, links, images, and semantic containers can remain, while scripts, stylesheets, iframes, SVG/math payloads, forms, embeds, event-handler attributes, unsafe URL schemes, and unknown active tags are removed. It runs in your browser and does not upload the HTML.

Worked example:

Input:

```html
<p onclick="alert(1)">Hello <a href="javascript:alert(1)">world</a></p><script>steal()</script>
```

Safe HTML output:

```html
<p>Hello <a>world</a></p>
```

Choose **Plain text** when you want visible copy only. Turn off links, images, classes/IDs, comments, or inline styles when preparing lean CMS-safe snippets.

## Limits and edge cases

- This tool is a conservative sanitizer for snippets and documents, not a full browser-grade HTML parser.
- `<script>`, `<style>`, embeds, frames, SVG, MathML, forms, media tags, and head-only tags are removed with their contents where appropriate.
- Inline `style` is off by default. When enabled, obvious script vectors such as `javascript:`, `expression()`, and unsafe `url(data:text...)` are still removed.
- Safe URL schemes include common web/contact schemes and relative URLs; suspicious schemes are dropped.
- Plain-text mode first sanitizes the HTML, then extracts visible text, so removed script/style content does not leak into the result.

## FAQ

<details>
<summary>Does this make arbitrary user HTML completely safe to render?</summary>

It removes common XSS vectors and risky tags with an allowlist, which is appropriate for cleaning snippets and reducing attack surface. If you are accepting untrusted HTML in a production application, also enforce server-side sanitization, content security policy, and framework-specific escaping.

</details>

<details>
<summary>What is the difference between safe HTML and plain text?</summary>

Safe HTML preserves allowed tags such as paragraphs, headings, lists, tables, links, images, and inline formatting after unsafe parts are removed. Plain text removes all markup after sanitization and returns the visible text.

</details>

<details>
<summary>Why are my classes, IDs, images, links, or styles missing?</summary>

Those controls are configurable. Disable classes/IDs for lean pasted markup, disable images or links when you do not want external references, and enable inline styles only when you need safe style attributes. Unsafe URL schemes and dangerous style values are removed even when the related option is on.

</details>

<details>
<summary>Does the tool upload my HTML?</summary>

No. The sanitizer runs locally in the browser page through WebAssembly. The CLI version also runs locally and returns the sanitized text directly.

</details>

## Related tools

- [HTML to Text](https://gizza.ai/tools/html-to-text/): Strip HTML markup to clean, readable plain text in your browser — keeps paragraph and list structure, removes all tags. Free, private, no upload, no sign-up.
- [Readability Extractor](https://gizza.ai/tools/readability-extractor/): Paste a web page's HTML and extract just the main article — title and body — with navigation, ads, and boilerplate stripped. Free, runs in your browser.
- [Code Chunker](https://gizza.ai/tools/code-chunker/): Split Python, Rust, JavaScript, TypeScript, Go, Java, C/C++, C#, PHP, or Swift into line-ranged chunks that keep functions and classes intact.
- [Code Formatter](https://gizza.ai/tools/code-formatter/): Beautify and re-indent minified or messy HTML, CSS, JavaScript, or JSON. Auto-detect the language, choose spaces or tabs, and format locally in your browser.
- [CSS Autoprefixer](https://gizza.ai/tools/css-autoprefixer/): Free online CSS autoprefixer — paste CSS and add the -webkit-, -moz-, -ms-, -o- vendor prefixes browsers still need. Runs entirely in your browser.