SVG Sanitize
What SVG Sanitize actually does
An SVG is a document, not an image, so accepting one is closer to accepting HTML than to accepting a PNG. Most sanitizers decide safety from a list of forbidden element names, which is why a run of recent advisories all describe the same escape: a SMIL animation element is not on the list, and it can set a link's href to a javascript URL after the file has already been checked. This tool decides from what an attribute is allowed to become rather than from what an element is called, shows the drawing before and after so a destructive clean is visible immediately, and lists every removed item by name.
How to use it
- Choose one SVG or a batch. Nothing is uploaded.
- The file is parsed, checked and rewritten in this tab.
- Compare the original and the result side by side; the preview loads each as an image, which cannot run script.
- Read the receipt to see exactly what came out, then download the sanitized file.
Useful for
- Vetting an SVG logo or icon from a marketplace before inlining it in a page.
- Clearing user-uploaded vector files that will be served back to other people.
- Checking whether a file a scanner flagged actually carries active content.
Limits worth knowing
- An animation whose target is a link is removed outright rather than repaired, so a file that animated a link loses that animation.
- This checks the document, not the rendering. A file that is safe can still draw something misleading.
- External references are removed rather than fetched and inspected, so a legitimate remote reference will not survive.
Questions people ask
Is removing script tags not enough?
No. An animation element can install a value on another element after parsing, so a check that only reads element names never sees the value it will install. Published advisories against several products describe exactly that bypass.
Will my animations survive?
Animations of paint and geometry such as fill, offset, d, width and transform are kept. Only animations that target a link or source attribute, or that carry a URL value the tool refuses, are removed.
Is it safe to preview a hostile file here?
Yes. Both previews load the markup as an image rather than inserting it into this page, and an SVG loaded as an image cannot run script.