Sanitise HTML

Strip untrusted HTML down to an explicit allowlist and download the sanitised document.

HTMLsanitiseallowlistText

Upload

Options

Questions people ask

Which elements survive the standard policy?: Paragraphs, headings 1 to 6, lists, tables, blockquotes, figures, details and summary, code and preformatted blocks, inline marks such as strong, em, mark, kbd, sub and sup, plus a and img when you allow them. Everything else, including script, style, iframe and form controls, is removed; script and style also lose their text content, so nothing leaks inline.
Which attributes survive?: The class attribute on everything kept in the policy, href and title on links, src, alt, width and height on images, and column and row spans on table cells. Strict policy keeps only the code element's class. Identifiers, styles, on* handlers and everything else are removed.
What happens to links?: A kept link gets a rel attribute of "noopener noreferrer" added for safety, and its target must be an http, https or mailto URL; javascript: and data: targets lose the link target. Relative URLs pass through untouched: the tool never fetches anything, so leaving them alone is safe; they will resolve inside whatever page you embed the output in.
Does sanitisation make arbitrary HTML safe?: It removes what this allowlist policy does not permit, which covers the classic embedding risks (script, handlers, unsafe URLs, comments). It cannot make arbitrary HTML harmless in every embedding context: embed the result inside a context you control, and prefer a frame sandbox for untrusted sources.
Are the removal counts exact?: They come from a permissive parse of your input against the chosen policy, named by element where it matters, and they are diagnostics: the sanitiser is the only authority on the actual output. Malformed markup is tolerated and normalised rather than refused, so a broken document still comes back clean.
What happens to my files?: The upload is deleted as soon as processing finishes; the sanitised document stays downloadable for about 10 minutes, then is deleted automatically.

About this tool

A single-pass sanitiser that states its policy out loud: the standard allowlist keeps the common formatting, structure and media tags, strict keeps a minimal text set, and refusals carry more meaning than silence. Comments are always removed (they can carry conditional-execution payloads), and content-bearing unsafe tags such as script, style, iframe and svg lose their content rather than leaking it as inline text. Technical details: the engine is ammonia through its nh3 bindings; URLs are filtered to http, https and mailto schemes, kept links gain a rel="noopener noreferrer" hardening, and the pre-scan that produces the removal counts parses with the forgiving standard parser and never executes or fetches anything. Input is read as UTF-8 (a BOM is tolerated) with a counted latin-1 fallback, and the output is byte-stable for identical input and options. Honest limits: sanitisation reduces risk against this allowlist policy; it does not make arbitrary HTML harmless in every embedding context. Embed the result inside a context you control, and prefer a frame sandbox for untrusted sources. The removal counts are best-effort diagnostics from the pre-scan, not a certificate about the output.

File limits

Between 0 and 1 files per job
Each at most 4 MiB
Result at most 8 MiB

Supported formats

HTML Text

Capabilities

HTMLsanitiseallowlist

Privacy & processing

Your file is processed in an isolated job on Tooley's own infrastructure. No third-party services are involved and nothing is stored beyond the result window.

Uploads are removed as soon as processing finishes. Results stay available for about 10 minutes, then they are deleted automatically.