HTML Cleaner & Sanitizer
Paste HTML, pick a policy, and press the button. You get the cleaned markup plus an itemised report of every tag and attribute that was dropped — and you can overrule any single decision without pasting anything again.
How it works
Bring the HTML in
Paste it, drop a .html file, or arrive from another tool. It just sits there — opening a file never starts the cleaning.
Choose the policy
Four presets cover the usual cases. Open the manual panel to edit the tag list, the attribute list and the accepted URL schemes yourself.
Run it
One pass builds the cleaned tree and records every decision on the way. A megabyte of markup takes a few milliseconds.
Review and overrule
The report lists what went and why. Disagree with any row and press Keep: the pass runs again with that one exception.
What it does
Real allow-list policy
Tags, attributes and URL schemes are separate lists you control. Blocking a tag but leaving its attributes untouched is not sanitising.
Itemised removal report
Every dropped element and attribute is grouped with a count, a sample of what it held, and the reason it went.
Overrule any decision
Press Keep on a row and the sanitiser runs again allowing exactly that one thing. Your original text is never edited.
URL schemes are checked
javascript:, data:text/html and vbscript: in href, src, formaction, srcset or xlink:href are caught, including whitespace and entity tricks.
Sandboxed preview
The result renders in an iframe with an empty sandbox and no-referrer, so nothing in it can run, submit or navigate.
Pretty, minified or as-parsed
Re-serialise the same cleaned tree three ways. Whitespace inside <pre> is preserved even when the rest is re-indented.
Hands off to the next tool
Send the result straight to DiffSnap, CodeCard, WordFlow, Base64Bolt or ZipFlow without a download-and-upload round trip.
Nothing leaves the tab
The sanitiser is a JavaScript library bundled with the page. There is no upload, no API call and no CDN fetch at any point.
A sanitiser that shows its work
Most online HTML cleaners hand you a string and expect you to trust it. This one keeps the decision log: which tag was dropped, which attribute was stripped, which URL failed the scheme check — and lets you overrule any of it in one click, because the cleaned output is regenerated from your policy rather than patched after the fact.
100% local
No uploads, no API keys, no tracking of what you paste. The library is bundled with the page, so nothing is fetched from a CDN either. Your HTML stays in the tab's memory and disappears when you close it.
When you need it
Cleaning what a rich-text editor produced before storing it. Stripping Word and Google Docs cruft out of a CMS paste. Making third-party markup safe to render. Pulling readable text out of a saved page. Checking whether the markup you are about to trust contains anything that could execute — the sample of known payloads is there so you can see the answer rather than assume it.
The parsing and the security decisions come from DOMPurify, the library that browsers' own security teams cite, rather than a hand-written pass over querySelectorAll. It is used through its hook API and asked for the intermediate DOM rather than a finished string, which is what makes the removal report and the per-item overrides possible. It handles mutation XSS, namespace confusion and the URL tricks a naive cleaner misses.
Frequently Asked Questions
QWhy does nothing happen when I paste?+
By design. Pasting or opening a file only loads the HTML; the sanitiser runs when you press Sanitize. That way you choose the policy first instead of watching the tool guess, and a large document is never parsed on every keystroke.
QWhat does the removal report actually let me do?+
Every row is a decision you can reverse. Pressing Keep adds that one exception and runs the whole pass again — so allowing <iframe> back does not also let its onload attribute through. Your input text is never rewritten, which is why undo and redo stay cheap.
QDoes whitelisting tags make the output safe on its own?+
No, and that is the mistake most tag-only cleaners make. An <a> tag on any allow list can still carry href="javascript:…", so attributes and URL schemes are checked separately here. Blocking a tag while leaving its attributes untouched is not sanitising.
QWhich URL schemes get through?+
Only the ones you tick. Everything else is dropped from href, src, srcset, action, formaction, poster, cite and xlink:href, including values hidden behind tabs, newlines or HTML entities. data: is limited to raster images — an SVG data URL runs its own script when opened directly, so it is never allowed.
QIs the live preview safe?+
Yes. It renders in an iframe with sandbox set to the empty string, which blocks scripts, forms, popups and navigation, plus a no-referrer policy so any surviving image cannot leak the page you came from.
QIs my HTML sent anywhere?+
No. The sanitiser is JavaScript bundled with this page and runs in your tab. There is no upload, no API call, and no CDN request — you can check with the network tab open.
QHow big a document can it handle?+
Parsing is roughly linear, so a few megabytes of markup finish in well under a second on a normal laptop; the measured time is shown after every run. Syntax highlighting in the output pane switches off above 200 KB, since colouring costs more than it is worth at that size.