DOMOxide
A Rust + WebAssembly HTML sanitizer built to strip XSS attack vectors roughly 70x faster than DOMPurify.
🔗 Visit DOMOxide
Description
If your website lets people type text that ends up shown to other visitors, comments, bios, forum posts, that text can secretly contain malicious code that hijacks other people's browsers. This is called an XSS attack, and the fix is to strip out anything dangerous before displaying it. DOMOxide is a small tool that does exactly that: it takes user-submitted HTML and gives back a clean, safe version with no working scripts.
DOMOxide is an HTML sanitization library written in Rust and compiled to WebAssembly for near-native speed in the browser or in Node.js. It exposes a DOMPurify-compatible API, so most projects can adopt it as a drop-in replacement, and its authors claim roughly 70x faster processing than DOMPurify while passing 218 of DOMPurify's own 219 test cases. It ships with configurable allow/deny rules for tags and attributes and integrates with common bundlers (Vite, Next.js, Webpack, Rollup) as well as browser CDN delivery.
💬 Our review
The short version: DOMOxide is a credible, much faster alternative to DOMPurify for teams that sanitize a lot of HTML and feel the performance cost, but it's young and less battle-tested.
DOMPurify has years of production hardening across huge numbers of sites; DOMOxide is newer, and passing 218/219 of DOMPurify's test suite is reassuring but not identical to DOMPurify's own track record against real-world attack payloads discovered over a decade. The performance claim (~70x) is real for CPU-bound sanitization at scale, think user-generated content platforms processing thousands of documents, but for a typical app sanitizing a handful of comments per request, the speed difference won't be noticeable. It's free, open-source (Apache-2.0), and the DOMPurify-compatible API makes trying it low-risk. Worth adopting if you're CPU-bound on sanitization; not an urgent swap otherwise.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit et open-source, licence Apache-2.0
Pros
Jusqu'à 70x plus rapide que DOMPurify sur de gros volumes
API compatible DOMPurify, migration à faible risque
Open-source et gratuit (Apache-2.0)
Compatible avec les principaux bundlers et CDN
Cons
Bien plus jeune que DOMPurify, moins de retours terrain
Le gain de vitesse n'est perceptible qu'à fort volume
Écosystème de plugins/extensions encore limité