HTML Editor

Sanitized HTML preview for a 50 characters across 1 line(s).

How it works

• The HTML fragment is passed through the allowlist sanitizer before it is shown.
• Active content (scripts, event handlers, dangerous URLs, SVG/MathML and external resources) is removed; the result is rendered only inside an empty-token sandboxed preview.
• Counts: 50 characters, 2 words, 1 lines.

Methodology

1. Scan the fragment into text and tag tokens, tracking quoted attribute values so a `>` inside an attribute never ends a tag.
2. Remove active and embedded elements (script, style, iframe, object, SVG/MathML and their content) and drop resource elements.
3. Keep only allowlisted tags and attributes; remove every `on*` handler and any URL whose scheme (after entity decoding) is dangerous.
4. Render the sanitized fragment only inside an empty-token sandboxed preview frame.

Usage

1. Type or paste an HTML fragment into the editor; the sanitized preview updates as you type.
2. Use Format to indent the markup with the shared HTML formatter.
3. Turn on “Keep in this browser” to autosave locally; use Clear/Reset to remove the stored document.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

A heading and a paragraph

{
  "text": "<h1>Title</h1><p>Hello <strong>world</strong>.</p>"
}

Renders accepted markup as-is.

A script tag is removed

{
  "text": "<p onclick=\"steal()\">Hi</p><script>alert(1)</script>"
}

The event handler and script element do not survive sanitization.

Limitations

What is removed

Scripts, styles, embedded documents, SVG/MathML, event-handler attributes and dangerous URLs are removed, and only allowlisted tags and attributes survive.

The sanitized result renders inside an empty-token sandbox, so even a sanitizer miss cannot execute a script.

Local-only autosave

Autosave is off by default. When enabled, the fragment is stored only in this browser and Clear/Reset removes it.