Is this tool private?

Yes. All processing happens locally in your browser. No data is uploaded.

What extras does this tool have?

Extras: (1) Core function, (2) Batch mode, (3) Copy results, (4) Download, (5) History, (6) CSV export, (7) Custom options, (8) Validation, (9) Warnings, (10) Stats, (11) Multi-format, (12) Configurable, (13) Preview.

Network, Runs in your browser

XSS Code Sanitizer

Sanitize HTML against XSS with context-aware output encoding and allowlists. 100% private. 100% private.

100% Private Works Offline Instant

HTML input

Allowed tags (comma-sep)

Allowed attributes (comma-sep)

Allow image data: URIs

severity: critical0 tags0 attrs1 events1 js: URLs

Sanitized output

<p>Hello <a href="#">click</a> <img src="x"></p>

⚠ Inline event handlers (on*) removed.

⚠ javascript: URLs neutralised.

Context-aware encoder

Input

Context

Encoded (html)

<script>alert('xss')</script>

Batch severity distribution

info

low

medium

high

critical

Total removed patterns across all 5 contexts: 0

Privacy: all sanitization happens locally. No HTML is uploaded.

Sanitize HTML against XSS with context-aware output encoding and allowlists. 100% private. 100% private. Everything runs locally in your browser — your data never leaves your device.

How to use

Enter your input in the tool above.
Adjust any options to your preference.
Use the Copy or Download buttons to save the result.
Everything happens locally — your data never leaves your browser.

All tools