SVG Inspector & Sanitizer
Inspect SVG structure for scripts, event handlers, and external references, then rebuild a sanitized allowlisted file.
SVG source is parsed as data locally and is never rendered as an active document.
SVG source
Drop an SVG file here or paste its source below.
Inspection
No SVG inspected yet.
Sanitized SVG
Sanitized preview
How to inspect an SVG file
Load or paste SVG source. It is parsed as XML data and never inserted into the active document. The inspector reports active content, event handler attributes, external references, embedded content, style blocks, and unsupported elements or attributes.
What can make an SVG risky?
SVG can contain scripts, event handlers, external resource references, embedded HTML through foreignObject, and CSS that loads resources. Opening untrusted SVG as an active document can expose users to more than a static image risk.
How SVG sanitization works
The sanitizer rebuilds a new document using an explicit element and attribute allowlist. Scripts, embedded content, event handlers, style elements, and external URLs are removed. Internal fragment references are kept only when their target still exists. The serialized result is parsed again before it is offered for download.
Limitations of automated sanitization
Sanitization reduces identified risks but does not guarantee safety in every rendering environment. The allowlist intentionally drops features such as text elements, filters, and external images. Review the output and apply your application's own content security policy.
Frequently asked questions
Is the source SVG rendered?
No. Only the sanitized output is previewed, and it is rebuilt from allowlisted nodes.
Why did my gradient or text disappear?
Features outside the conservative allowlist are removed. This is a deliberate safety trade-off.
Does “no findings” mean the file is safe?
No. It means the implemented checks found nothing. It is not a universal security score.