html-sanitizer
HTML sanitizer
Decision gist · record as of 2026-08-14
Yes, with conditions. Install if you need strict, opinionated HTML sanitization with structural normalization and you are comfortable with an aging but stable codebase. The low install friction, permissive license, zero known vulnerabilities, and active repository make it safe to adopt. However, the 410-day release cycle suggests limited active development; verify that its feature set and dependency versions align with your current stack before committing to a long-term dependency.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low install friction with a pure-Python wheel and only three runtime dependencies (beautifulsoup4, lxml-html-clean, lxml).
- Maintenance status is aging—last release was 410 days ago—but the repository remains active with a recent commit on 2025-06-30 and no archived status.
License · maintenance · safety
BSD-3-Clause (permissive) — BSD-3-Clause is a permissive license; you may use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
last release 2025-06-30 (410 days) · last repo commit 2025-06-30 · 153 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 916,770 downloads/mo, #4,729 on PyPI
Alternatives
Verify before relying
from html_sanitizer import Sanitizer
sanitizer = Sanitizer()
result = sanitizer.sanitize('<p>some text</p>')- Whether the 410-day release cycle reflects active maintenance or stable-but-dormant status
- Performance characteristics on large HTML documents or high-throughput sanitization workloads
- Compatibility with recent versions of beautifulsoup4 and lxml beyond the stated Python version support
What it is and what it does
HTML sanitizer is an allowlist-based HTML cleaner that removes unsafe content and normalizes structure. It takes HTML fragments (from rich-text editors, copy-paste, or untrusted sources) and produces valid, safe output by enforcing a configurable set of allowed tags and attributes, stripping inline styles and scripts, and applying structural transforms—for example, converting `<b>` and `<i>` tags to `<strong>` and `<em>`, or merging adjacent identical tags.
It builds on lxml's HTML cleaner and goes further than simpler alternatives by not only blocking unsafe content but also normalizing whitespace, removing empty elements, and applying element preprocessors and postprocessors. Configuration is highly opinionated by default (allowing only semantic tags like headings, lists, links, and emphasis) but can be customized. It includes optional Django integration for managing multiple sanitizer configurations via settings.
Use it for
- Sanitize user-submitted HTML in comment systems or forum posts before storage or display
- Clean up messy HTML from copy-pasted content in rich-text editors to enforce consistent styling
- Remove XSS attack vectors from untrusted HTML sources before rendering in web pages
- Normalize and validate HTML fragments in content management systems or static site generators
- Convert non-semantic formatting tags (bold, italic) into semantic equivalents for accessibility
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Install if you need strict, opinionated HTML sanitization with structural normalization and you are comfortable with an aging but stable codebase. The low install friction, permissive license, zero known vulnerabilities, and active repository make it safe to adopt. However, the 410-day release cycle suggests limited active development; verify that its feature set and dependency versions align with your current stack before committing to a long-term dependency.
Install
html-sanitizer on PyPI
Before you install
Low install friction with a pure-Python wheel and only three runtime dependencies (beautifulsoup4, lxml-html-clean, lxml). Maintenance status is aging—last release was 410 days ago—but the repository remains active with a recent commit on 2025-06-30 and no archived status.
License in practice
BSD-3-Clause is a permissive license; you may use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.
Quickstart
from html_sanitizer import Sanitizer
sanitizer = Sanitizer()
result = sanitizer.sanitize('<p>some text</p>')Verify before relying
- Whether the 410-day release cycle reflects active maintenance or stable-but-dormant status
- Performance characteristics on large HTML documents or high-throughput sanitization workloads
- Compatibility with recent versions of beautifulsoup4 and lxml beyond the stated Python version support
Package facts
| License | BSD-3-Clause permissive |
| Python support | Supports the current Python release >=3.8 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 3 packagesbeautifulsoup4lxml-html-cleanlxml |
| Maintenance | Aging 410 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 916,770 / month, #4,729 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: Web EnvironmentFramework :: DjangoIntended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Internet :: WWW/HTTP :: Dynamic ContentTopic :: Software Development |
Evidence: html_sanitizer-2.6.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “html sanitizer allowlist”
- html-sanitizerSanitizes HTML fragments by enforcing an allowlist of safe tags and…
- bleach-allowlistProvides curated allowlists of HTML tags, attributes, and CSS styles…
- django-bleachIntegrates bleach HTML sanitization into Django models, forms, and…
Give your agent the search over MCP, or paste the wish link into any chat.
More Software Development packages
Provides backported and experimental type hints for Python 3.9+, allowing use of newer typing features on older Python versions and enabling early experimentation with type system PEPs before they enter the standard library.
NumPy provides an N-dimensional array object and a comprehensive suite of mathematical, linear algebra, Fourier transform, and random number functions for scientific computing in Python.
FastAPI is a Python web framework for building REST APIs using type hints, with automatic request validation, serialization, and interactive API documentation.
Provides a way to document function parameters, class attributes, return types, and variables inline using Python's `Annotated` type hint syntax instead of traditional docstrings.
Typer builds command-line applications from Python functions using type hints, automatically generating help text, argument parsing, and shell completion.
Install it if you are building CLIs in Python.
Distlib provides low-level packaging utilities for building, distributing, and managing Python software—including metadata handling, version specifiers, wheel support, script installation, and dependency resolution.
See also django-bleach · textile · bleach-allowlist · html-void-elements · py_svg_hush · lxml-html-clean · bleach · sanitize-filename · html-text · django-markdownify