Is client-side sanitising enough to be secure?

For displaying untrusted content in the page you are already in, yes. As a security boundary for data you then send to a server, no — an attacker controls their own browser and can bypass any client-side step. Always sanitise again server-side before storing or serving content to other users.

What is actually being removed?

Script tags, event handler attributes like onclick and onerror, javascript: URLs, style tags that can be abused, and data: URIs that can carry executable content. Which of these are stripped depends on the mode you choose.

Why use a library rather than regex?

Because HTML parsing is genuinely hard and regex-based sanitising has been defeated repeatedly by encoding tricks, malformed markup and parser quirks. DOMPurify parses the document properly and works from an allowlist, which is why it is the standard answer.

Which mode should I choose?

Strict for comments and user-generated text, where formatting is all you need. Basic where users legitimately need links and headings. Permissive only where you largely trust the source and simply want scripts removed.

When should I use HTML Sanitizer?

Use it to audit HTML from a rich-text editor, test whether a ` ` payload sneaks through your allow-list, clean pasted Word/Google Docs HTML before saving it, or preview sanitized output before wiring DOMPurify into your app.

Will quality be affected by HTML Sanitizer?

HTML Sanitizer performs lossless operations — your content is not re-encoded or downgraded.

Is this a replacement for sanitizing on the server?

No — always sanitize on the server too. Client-side sanitization is the last line of defense before render; server-side sanitization is the source of truth for what you store. A malicious client can send anything to your DB.

Why is ` ` removed by default?

` ` blocks can contain CSS that loads external resources (`url("javascript:...")` in older browsers, or CSS-based data exfiltration). Strip unless you specifically need it and trust the source.

How do I integrate this into my app?

Install DOMPurify (`npm i dompurify`) and call `DOMPurify.sanitize(dirty, { ALLOWED_TAGS: [...] })` before every `innerHTML` / `dangerouslySetInnerHTML` write. This tool lets you dial in the allow-list before you commit it to code.

HTML Sanitizer

Sanitize HTML to prevent XSS attacks

How to Use HTML Sanitizer

Paste the HTML you want to clean.
Choose a mode: Strict for text formatting only, Basic to allow links and common markup, Permissive to strip only scripts and event handlers.
Review the threat counter and the cleaned output.
Copy the sanitised HTML.

About HTML Sanitizer

What this page solves

Rendering user-submitted HTML — from a comment box, WYSIWYG editor, or Markdown import — without sanitizing is the top source of XSS on the web. This tool strips dangerous tags, attributes, and URLs client-side so you can preview exactly what your app will render.

HTML Sanitizer strips XSS-dangerous tags (`