html-sanitizer

What it is and what it does

HTML sanitizer is an allowlist-based HTML cleaner that removes unsafe content and normalizes structure. It takes HTML fragments (from rich-text editors, copy-paste, or untrusted sources) and produces valid, safe output by enforcing a configurable set of allowed tags and attributes, stripping inline styles and scripts, and applying structural transforms—for example, converting `<b>` and `<i>` tags to `<strong>` and `<em>`, or merging adjacent identical tags.

It builds on lxml's HTML cleaner and goes further than simpler alternatives by not only blocking unsafe content but also normalizing whitespace, removing empty elements, and applying element preprocessors and postprocessors. Configuration is highly opinionated by default (allowing only semantic tags like headings, lists, links, and emphasis) but can be customized. It includes optional Django integration for managing multiple sanitizer configurations via settings.

Use it for:

• Sanitize user-submitted HTML in comment systems or forum posts before storage or display
• Clean up messy HTML from copy-pasted content in rich-text editors to enforce consistent styling
• Remove XSS attack vectors from untrusted HTML sources before rendering in web pages
• Normalize and validate HTML fragments in content management systems or static site generators
• Convert non-semantic formatting tags (bold, italic) into semantic equivalents for accessibility

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Sanitizes HTML fragments by enforcing an allowlist of safe tags and attributes, removing inline styles and scripts, and normalizing structure to produce valid, consistent output.

Yes, with conditions. Install if you need strict, opinionated HTML sanitization with structural normalization and you are comfortable with an aging but stable codebase. The low install friction, permissive license, zero known vulnerabilities, and active repository make it safe to adopt. However, the 410-day release cycle suggests limited active development; verify that its feature set and dependency versions align with your current stack before committing to a long-term dependency.

Install

html-sanitizer on PyPI

pip install html-sanitizer

uv add html-sanitizer

poetry add html-sanitizer

Installing html-sanitizer

Before you install

Low install friction with a pure-Python wheel and only three runtime dependencies (beautifulsoup4, lxml-html-clean, lxml). Maintenance status is aging—last release was 410 days ago—but the repository remains active with a recent commit on 2025-06-30 and no archived status.

License in practice

BSD-3-Clause is a permissive license; you may use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart

from html_sanitizer import Sanitizer
sanitizer = Sanitizer()
result = sanitizer.sanitize('<p>some text</p>')

Verify before relying

• Whether the 410-day release cycle reflects active maintenance or stable-but-dormant status
• Performance characteristics on large HTML documents or high-throughput sanitization workloads
• Compatibility with recent versions of beautifulsoup4 and lxml beyond the stated Python version support

Package facts

Evidence: html_sanitizer-2.6.0-py3-none-any.whl

Tags

More Software Development packages