Free SVG Viewer & Sanitizer

How this tool computes its result

Applies four sequential regex-based string replacements to pasted SVG markup: strips entire <script>...</script> blocks, strips entire <foreignObject>...</foreignObject> blocks, removes any inline event-handler attribute (on*="...") in both double- and single-quoted forms, and neutralizes javascript: URLs in href/xlink:href attributes by replacing them with "#". A separate lightweight check just verifies the pasted text contains a literal "<svg" substring (case-insensitive) and shows a warning if not, without blocking sanitization. The preview panel renders the sanitized output via dangerouslySetInnerHTML.

Worked example

Pasting `<svg onload="alert(1)"><circle onclick='steal()' r="5"/><a href="javascript:evil()">click</a></svg>` produces `<svg><circle r="5"/><a href="#">click</a></svg>` -- all three attack vectors (onload, onclick, javascript: href) are stripped in one pass.

When not to use this tool

The sanitizer is 4 fixed regex patterns, not a real SVG/XML parser or an allowlist-based sanitizer -- it does not catch every documented SVG XSS vector (CSS expression() in style attributes, malicious <use href> references, tags crafted to evade regex boundaries), so treating the output as fully safe for untrusted third-party SVG carries real risk this tool does not fully close.

Common mistakes

• - Trusting the sanitized output as production-safe for user-submitted SVG from unknown sources -- regex-based sanitization is inherently bypassable; a maintained allowlist parser library is the safer choice there, this tool suits quick cleanup of markup you already trust.
• - Assuming the "<svg" substring check validates well-formed XML -- it is a literal text search, not a parser, so malformed SVG (unclosed tags, mismatched namespaces) passes this check and still gets rendered via dangerouslySetInnerHTML in the preview.
• - Not noticing <foreignObject> is deleted entirely rather than sanitized -- if you intentionally embed HTML content inside your SVG via foreignObject, this tool removes that content wholesale instead of cleaning it.

Related tools