Sanitize HTML input by removing dangerous tags, attributes, and event handlers. Preview safe output in an isolated iframe.
Pasted markup is treated as content to clean, not as a page to trust. The HTML Sanitizer & XSS Cleaner removes dangerous elements, unsafe attributes, and inline event-handler attributes, returns the remaining HTML, and renders that result in an isolated iframe for inspection. The common surprise is that a harmless-looking preview is not a universal security verdict. HTML safety depends on where the result is later inserted and whether another step decodes, concatenates, or modifies it. Review the returned markup, not just its appearance, before using it elsewhere.
The cleaner evaluates the submitted HTML fragment against its sanitization policy. It removes dangerous elements, unsafe attributes, and inline event-handler attributes while leaving permitted markup available as output. Compare the source and result directly: the absence of an active effect in the preview does not reveal every discarded input token, and surviving text does not prove that its original enclosing element survived.
The preview renders the cleaned result, rather than the original input, inside an isolated iframe. This provides a bounded place to inspect how the surviving markup behaves without inserting the submitted fragment directly into the surrounding tool page. That isolation applies only to this preview. The same output may render differently when copied into a document with different styles, scripts, permissions, or surrounding markup.
No, not by itself. The result is a cleaned fragment under this tool's policy, but publication safety also depends on the destination context and later processing. Validation or sanitization at the application's trust boundary remains appropriate, especially for stored input. Do not place the result inside JavaScript, CSS, or a URL and assume HTML sanitization covers that context.
Not necessarily. Any tag or attribute categorized as dangerous can disappear, so interaction, embedded content, or presentation attached to that markup may change. The isolated preview helps reveal visible breakage, but inspect the cleaned source as well. Removed metadata, event handlers, or structural elements may not produce an obvious visual difference.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.