HTML Attribute Cleaner

Choose which attribute families to remove, preview cleaned body markup, and copy the local result without executing the HTML.

HTML body markup

Cleaned HTML

ReadyThis transforms attributes in parsed body markup; it is not a complete HTML sanitizer and should not be used as the sole XSS defense.

Source & result review

Inspect what the browser parsed and what the tool produced

DOMParser ≠ sanitizer

Ready to inspect source and result.

Review is local and detached: this panel never inserts pasted markup into the live page. A browser parser can normalize malformed HTML, but successful parsing does not make markup safe to inject. Scripts, inline event attributes and embedded browsing/plugin elements are reported as active-content signals, not executed.

Preview custom attribute rules

The main cleaner handles common attribute families. Before applying a custom policy elsewhere, preview exact-name and prefix rules against the HTML currently in the source box and see which attributes would be removed or protected.

Remove exact namesRemove prefixesAlways keepName matching

—Attributes matched

—Elements affected

—Protected matches

—Rule conflicts

Ready.

Attribute	Occurrences	Decision	Why

This is an impact preview. It does not replace the cleaner or a security sanitizer; URL, element and context rules still require application-specific review.

Browser-local does not mean standards-complete

HTML parsing is error tolerant. Source diagnostics, sandboxed previews, and transformations do not replace full conformance, security, or production-browser testing.

Attribute cleanup is a transform, not XSS protection

Review which attributes were removed and re-check the generated markup. Removing selected on*, style, class, id, data-* or ARIA attributes is not equivalent to a context-aware HTML sanitizer.

Parser and sanitizer boundary

HTML DOMParser creates a detached document and may repair or normalize markup. That is useful for inspection, but parsing alone does not sanitize untrusted HTML. Review scripts, inline event attributes, embedded content and application-specific URL/context rules before any live-DOM insertion.