Skip to content
Convertto

Sanitize Untrusted Text Before It Reaches a Model

Strip invisible carriers, neutralise instruction-like markup and fence untrusted content before you paste it into a prompt.

This tool prepares untrusted text for inclusion in a prompt: it strips invisible carriers such as Unicode tag characters and bidirectional overrides, escapes structural markup so the content cannot break out of its own delimiter, wraps it in a fence with an explicit data-not-instructions preamble, and reports any instruction-shaped phrases for review rather than silently deleting them.

Runs in your browser
Privacy
Runs entirely in your browser — nothing is uploaded
Cost
Free, unlimited, no sign-up

Frequently asked questions

Does this make my application injection-proof?

No, and any tool that claims otherwise is selling something. Sanitising input removes the invisible carriers and stops content escaping its delimiter, which is worth doing. It cannot stop a plainly-worded instruction, because that is indistinguishable from legitimate content. The defences that work are architectural: least privilege, confirmation on irreversible actions, and keeping credentials out of the model context.

Why not just delete the suspicious phrases?

Because a security document, a bug report or a page about prompt injection legitimately contains those phrases, and silently editing a document you were asked to analyse is its own bug. They are reported so a human can decide.

How to use the prompt injection sanitizer

  1. 1Enter or paste your untrusted text.
  2. 2Turn "Fence the content" on or off as needed.
  3. 3Choose the fence style.
  4. 4Turn "Neutralise structural markup" on or off as needed.
  5. 5Press Run, then download the result when it is ready.

Sources & specifications

Embed this tool

Put the working prompt injection sanitizer on your own site. It runs in your visitors' browsers exactly as it does here — free, no account, nothing uploaded.

Share this tool

Last updated

More ai & llm tools