Test HTML sanitization by comparing raw input against DOMPurify and browser-native sanitization output.
Paste an HTML fragment to examine three distinct views: the source as entered, the markup accepted by DOMPurify, and the markup accepted by the browser's native sanitization facility. The comparison reveals removed elements, stripped attributes, and parser-driven normalization that can be difficult to notice during source review. The common mistake is treating unchanged or matching output as a universal safety verdict. The result describes only this fragment under these two sanitizers in the current browser; the eventual insertion context and later DOM changes still matter.
Raw input is the baseline. DOMPurify and the browser-native facility receive the same fragment as separate tests, so a tag or attribute that survives in only one sanitized result exposes a concrete policy difference. Inspect the returned markup, not only what it would look like when rendered, because event-handler and URL-bearing attributes can be visually silent.
Sanitization operates on parsed HTML structure, while the displayed result is serialized markup. HTML parsing can normalize quoting, casing, nesting, or omitted structure, so not every textual change represents removal of a security-sensitive feature. DOMPurify and the native sanitizer also need not share identical acceptance rules; equality on one fragment does not establish general equivalence.
No. Matching output proves only that both produced the same serialized result for that particular fragment under the conditions of the test. They may differ for other elements, attributes, namespaces, malformed markup, or browser versions. Test representative cases individually rather than treating one match as proof that the sanitizers have interchangeable policies.
No. Script removal is one useful observation, but active behavior can involve event attributes, unsafe URLs, embedded content, namespaced markup, or later DOM changes. Review the complete sanitized result and test it in the same kind of DOM sink used by the application. This tester compares transformations; it does not certify an entire rendering workflow.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.