--- id: html-sanitizer version: "2.6.0" license: BSD-3-Clause license_treatment: permissive maintenance: aging --- # html-sanitizer — HTML sanitizer License: permissive · Maintenance: aging · Downloads: 916.8K/mo ## What it is and what it does HTML sanitizer is an allowlist-based HTML cleaner that removes unsafe content and normalizes structure. It takes HTML fragments (from rich-text editors, copy-paste, or untrusted sources) and produces valid, safe output by enforcing a configurable set of allowed tags and attributes, stripping inline styles and scripts, and applying structural transforms—for example, converting `` and `` tags to `` and ``, or merging adjacent identical tags. It builds on lxml's HTML cleaner and goes further than simpler alternatives by not only blocking unsafe content but also normalizing whitespace, removing empty elements, and applying element preprocessors and postprocessors. Configuration is highly opinionated by default (allowing only semantic tags like headings, lists, links, and emphasis) but can be customized. It includes optional Django integration for managing multiple sanitizer configurations via settings. Use it for: - Sanitize user-submitted HTML in comment systems or forum posts before storage or display - Clean up messy HTML from copy-pasted content in rich-text editors to enforce consistent styling - Remove XSS attack vectors from untrusted HTML sources before rendering in web pages - Normalize and validate HTML fragments in content management systems or static site generators - Convert non-semantic formatting tags (bold, italic) into semantic equivalents for accessibility ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Sanitizes HTML fragments by enforcing an allowlist of safe tags and attributes, removing inline styles and scripts, and normalizing structure to produce valid, consistent output. Yes, with conditions. Install if you need strict, opinionated HTML sanitization with structural normalization and you are comfortable with an aging but stable codebase. The low install friction, permissive license, zero known vulnerabilities, and active repository make it safe to adopt. However, the 410-day release cycle suggests limited active development; verify that its feature set and dependency versions align with your current stack before committing to a long-term dependency. ## Install pip install html-sanitizer uv add html-sanitizer poetry add html-sanitizer ## Installing html-sanitizer Before you install: Low install friction with a pure-Python wheel and only three runtime dependencies (beautifulsoup4, lxml-html-clean, lxml). Maintenance status is aging—last release was 410 days ago—but the repository remains active with a recent commit on 2025-06-30 and no archived status. License in practice: BSD-3-Clause is a permissive license; you may use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions. Quickstart: from html_sanitizer import Sanitizer sanitizer = Sanitizer() result = sanitizer.sanitize('

some text

') Verify before relying: - Whether the 410-day release cycle reflects active maintenance or stable-but-dormant status - Performance characteristics on large HTML documents or high-throughput sanitization workloads - Compatibility with recent versions of beautifulsoup4 and lxml beyond the stated Python version support ## Package facts - License: BSD-3-Clause (permissive) - Python support: supports_current - Install friction: low - Maintenance: aging - Downloads: 916.8K/month (top 5,000 on PyPI) - Known vulnerabilities: none known ## Tags html sanitizer allowlist, clean untrusted html, remove html scripts styles, html fragment cleaner, safe html parser, xss prevention html, normalize html markup, html-sanitization, xss-prevention, django-friendly [View on SkillFed](https://skillfed.io/packages/html-sanitizer) · [View on PyPI](https://pypi.org/project/html-sanitizer/)