Test HTML sanitization with DOMPurify and configurable allow lists for tags, attributes, and URLs.
Paste an HTML fragment to see the markup DOMPurify returns after removing elements, attributes, and URL values that the selected allow lists do not permit. The controls let you test a policy for accepted tags, accepted attributes, and URLs instead of judging the original source by appearance alone. A common surprise is that permitting an element does not automatically permit every attribute or link value on it. Processing occurs in the browser, so potentially sensitive test markup is not uploaded.
A concrete input and expected output from the current implementation.
Input
<p>Hello</p><script>alert(1)</script>
Expected output
<p>Hello</p>
Under DOMPurify's default sanitization policy, the paragraph is retained and the script element, including its JavaScript content, is removed. The surviving HTML therefore contains only the paragraph.
DOMPurify evaluates the fragment as browser-parsed HTML and produces a cleaned fragment. Disallowed elements and unsafe attributes such as inline event handlers can be removed from the result. Because HTML parsing can repair malformed input or rearrange invalid nesting, the sanitized serialization may differ from the pasted source even when no obvious executable payload remains.
Tag, attribute, and URL permissions are separate parts of the test policy. An allowed anchor element, for example, does not imply that every attribute or every href value will survive. Adjusting one list can therefore change only part of an element. Review the returned markup to determine what DOMPurify retained under the exact settings being tested.
No. Element names and attribute names are evaluated separately, and URL-valued attributes can face additional restrictions. An allowed a element may remain while an event handler or unacceptable href is removed. Include every relevant policy control when testing, then inspect the serialized result instead of assuming that preservation of the outer tag means preservation of the original element.
No. It shows that this DOMPurify configuration did not alter that fragment. Safety still depends on where the result is inserted and whether application code later modifies it. Avoid passing sanitized markup into script, style, or other non-HTML contexts, and do not append unsanitized strings after sanitization.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.