Strip HTML Tags: What You Get and What You Lose
Content copied from page source or a rich text export arrives wrapped in tags. Removing them leaves the paragraphs you can paste into a plain text field.
When you actually need it
The usual case is moving page text into a plain text environment: an email, a Word document, a ticket, or a translation file, none of which want markup. Exports from rich text editors and HTML email templates need the same treatment before reuse.
Comparison is the other use. Diffing two HTML files directly produces a screen full of attribute changes, while diffing them after stripping the tags shows only what changed in the words. Bulk cleanups often start this way.
The rule is simple, and so is the trap
Only the span between angle brackets is removed. Text between tags survives, tag attributes disappear with the tag, so link targets are lost. Character entities are not decoded: & stays & and stays an entity, and needs separate handling.
The contents of script and style elements stay in the output, because the tag is removed and the text inside is not. That is the trap people hit most often. A comparison written as a < b > c in prose is also removed as if it were a tag, and an unclosed bracket can swallow a long stretch of following text.
- Entities stay encoded and need decoding separately
- Script and style contents remain
- Angle brackets in body text can be eaten
Alternatives and the security boundary
To extract the main article and drop navigation and ads, use a reader mode or a library such as Readability. To keep both link text and URLs, walk the DOM and read nodes instead of deleting tags wholesale. For malformed input, a browser HTML parser is more reliable than a regex.
Never treat this as a security filter. Removing tags is not escaping, and leftover entities and text can still be interpreted as markup. Preventing XSS means escaping by context on output, sanitising against an allowlist, and generating HTML on the server.
FAQ
Why is & still in the output?
The tool removes tags and does not decode entities. & represents an ampersand in HTML but is kept as written here. Use an entity decoder or a script when you need the real character.
Why is the script code still there?
The script tag is removed, but the text between the tags is content and stays. To drop it, use a DOM-aware tool that deletes the whole script node rather than only the tag.
Can I use this to prevent XSS?
No. Removing tags is not escaping, and the remaining content can still be interpreted by a browser. Escape by context on output, sanitise with an allowlist, and build HTML on the server.
Related tool：Strip HTML Tags