Are script and style contents removed?

Yes. Their content is markup, not text, so it goes with the tag rather than being left in the output.

Are HTML entities decoded?

Yes. An ampersand entity comes back as an ampersand, so the result reads as text rather than as half-decoded markup.

Is this safe to trust as sanitisation?

No. It is a text extractor, not a security boundary. If you are going to render untrusted input as HTML, sanitise it with a dedicated library.

Strip HTML tags API

Strip every HTML tag and decode entities, leaving readable plain text with line breaks preserved.

Get a free token Full API reference

Endpoint	POST https://astraltext.com/api/v1/remove-html-tags
Auth	Bearer token, free
Sends	input: text
Returns	result: text
Price	Free. 1,000 calls a day, 60 a minute.

When to call it

Scraped pages, CMS fields and email bodies arrive as HTML when what you need is the words: for a search index, a summary, a plain-text alternative or a character count that is not inflated by markup.

For a one-off, the browser version needs no token and never sends your data anywhere: it runs on your own machine.

Example

curl

curl -X POST https://astraltext.com/api/v1/remove-html-tags \
  -H "Authorization: Bearer ast_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": "<p>Hello <strong>world</strong> &amp; welcome.</p><script>alert(1)</script>"}'

response

{
  "tool": "remove-html-tags",
  "result": "Hello world & welcome.",
  "chars": 22,
  "ms": 2
}

In your language

JavaScript

const res = await fetch("https://astraltext.com/api/v1/remove-html-tags", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ASTRAL_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"input": "<p>Hello <strong>world</strong> &amp; welcome.</p><script>alert(1)</script>"}),
});
if (!res.ok) throw new Error((await res.json()).detail);
const { result } = await res.json();

Python

import os, requests

res = requests.post(
    "https://astraltext.com/api/v1/remove-html-tags",
    headers={"Authorization": f"Bearer {os.environ['ASTRAL_TOKEN']}"},
    json={"input": "<p>Hello <strong>world</strong> &amp; welcome.</p><script>alert(1)</script>"},
    timeout=30,
)
res.raise_for_status()
result = res.json()["result"]

Parameters

Field	Type	Notes
input	string	Required. Up to 200,000 characters per call.

Errors

Errors are RFC 7807 problem documents with a stable type you can branch on.

missing-token	401	No Authorization header.
bad-request	400	input missing or the wrong type.
tool-failed	422	The input could not be processed. detail says why.
quota-exceeded	429	Past 1,000 calls today.

Questions

Are script and style contents removed?: Yes. Their content is markup, not text, so it goes with the tag rather than being left in the output.
Are HTML entities decoded?: Yes. An ampersand entity comes back as an ampersand, so the result reads as text rather than as half-decoded markup.
Is this safe to trust as sanitisation?: No. It is a text extractor, not a security boundary. If you are going to render untrusted input as HTML, sanitise it with a dedicated library.

Other endpoints

A token takes thirty seconds

Free, no card, 1,000 calls a day, and the same token works on astraltext.com, astralpdf.com, astraljson.com and astralbatch.com.

Get a free token