# bluemonday

HTML sanitizer for Go that removes markup outside an allowlist from untrusted input, such as user generated content.


Source: https://findsoftware.frbit.cloud/bluemonday/
Last reviewed: 2026-11-04
Listed since: 2026-11-04

## Record

### Links

- repository: https://github.com/microcosm-cc/bluemonday

### Identity

- status: active
- maintainer: David Kitchen
- maintainerType: unknown
- parent: unknown
- firstRelease: 2018
- hqCountry: unknown

### Kind

- category: library
- hosting: binary
- language: go
- runtime: binary
- runtimeMin: unknown
- basedOn: unknown

### Content

- contentStore: not applicable
- databases: not applicable
- adminUi: not applicable
- headlessApi: not applicable
- templating: not applicable
- i18n: not applicable

### Rendering and deploy

- runsAs: not applicable
- renderingModes: not applicable
- installMethod: go get

### License

- licenseModel: open-source
- license: BSD-3-Clause

### Releases

- currentMajor: 1
- latestReleaseDate: 2024-07-04

### Adoption

- githubStargazers: 3731
- packagistDownloads: not applicable
- npmWeeklyDownloads: not applicable
- contributors: 29
- pluginCount: unknown
- packagistMonthlyDownloads: unknown
- ecosystemsMonthlyDownloads: unknown
- httpArchiveSites: unknown
- wordpressActiveInstalls: unknown
- dependentRepos: unknown
- dependentPackages: unknown

### Sources

- urls: https://api.github.com/repos/microcosm-cc/bluemonday (read 2026-11-04)
- maintainer: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/LICENSE.md (read 2026-11-04)
- language: https://api.github.com/repos/microcosm-cc/bluemonday (read 2026-11-04)
- runtime: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/README.md (read 2026-11-04)
- category: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/README.md (read 2026-11-04)
- installMethod: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/README.md (read 2026-11-04)
- license: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/LICENSE.md (read 2026-11-04)
- licenseModel: https://raw.githubusercontent.com/microcosm-cc/bluemonday/main/LICENSE.md (read 2026-11-04)
- firstRelease: https://proxy.golang.org/github.com/microcosm-cc/bluemonday/@v/v1.0.0.info (read 2026-11-04)
- currentMajor: https://proxy.golang.org/github.com/microcosm-cc/bluemonday/@v/v1.0.27.info (read 2026-11-04)
- latestReleaseDate: https://proxy.golang.org/github.com/microcosm-cc/bluemonday/@v/v1.0.27.info (read 2026-11-04)
- githubStargazers: https://api.github.com/repos/microcosm-cc/bluemonday (read 2026-11-04)
- contributors: https://api.github.com/repos/microcosm-cc/bluemonday/contributors?per_page=1 (read 2026-11-04)

## Notes

bluemonday is an HTML sanitizer for Go. It takes untrusted HTML, such as user generated content, and returns HTML limited to an allowlist of elements and attributes. A Go server builds a policy, either from the two policies the library ships or from its own rules, and applies it to each input. The library is installed with `go get`.

## Worth knowing

The README asks that bluemonday run after any other HTML processing, such as Markdown rendering, so that no unsanitized markup is added later. Script and style elements are dropped unless the policy enables them.

---

Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attributes are recorded, never scored; absent means unknown.
Credit, in full: FindSoftware, CC BY 4.0