Free Tool Desk

SVG Security Scanner

Scan an SVG file for embedded scripts, event handlers, and external references before you embed it — free and instant.

Free to use No sign-up required Files deleted after processing

Check whether an SVG file is safe to embed directly on a page you control — SVG is XML text that can carry scripts and event handlers, unlike a JPG or PNG's opaque pixel data, which makes a user- or client-submitted SVG (an avatar, a logo, an icon) worth vetting before it goes anywhere near your site.

Accepts SVG · up to 20 MB each

Choose a file before converting.

Processing your file…

This usually only takes a moment.

element(s) scanned.

Your file is processed on our server and deleted automatically afterward — see the privacy note below.

Overview

About SVG Security Scanner

Upload an SVG file and this tool scans it for the constructs that make SVG different from every other image format: because SVG is XML text, it can carry <script> elements, on* event-handler attributes, and references to external resources, all of which can execute or run when the file is embedded directly on a web page. This tool reports every risky construct it finds — not just the first one — so you can decide what to do with a file a user, client, or contributor submitted, without ever rendering it.

Compatibility

Supported Formats

Accepts SVG (.svg) input up to 2 MB with up to 5,000 elements. Reports every risky construct found — no output file is produced.

Guide

How to Use SVG Security Scanner

  1. Choose or drag in an SVG file.
  2. Click "Scan SVG for Risks".
  3. Review every finding, with a plain-language explanation of the risk each one poses.

Highlights

Features

  • Every finding, not just the first Unlike a simple accept/reject gate, this tool reports every risky construct in the file at once, so you can see the full picture before deciding what to do with it.
  • Never renders the file The SVG is parsed as plain XML text only — it is never rendered, converted, or executed, so scanning a genuinely malicious file is safe.
  • Plain-language risk explanations Every finding explains what the construct actually does and why it matters, not just a raw technical label.
  • No files retained This is a report-only tool — no output file is created, and your uploaded SVG is deleted automatically after the scan runs.

Applications

Use Cases

  • Vet a logo or icon a client submitted before adding it to a shared component library
  • Check a user-uploaded avatar SVG for embedded scripts before displaying it inline on a profile page
  • Audit a batch of SVG assets pulled from a third-party icon pack before shipping them

Good to Know

Limitations

This is a diagnostic scanner only — it does not modify, strip, or sanitize the file; convert with SVG to PNG instead if you need a safe raster copy. A file with a DOCTYPE/ENTITY declaration stops the scan at that single finding rather than parsing further, since fully parsing one risks the XXE attack it's flagging.

Files are processed on our servers and are not shared with third parties. Files are deleted as soon as processing or download finishes. Any leftover temporary file is removed automatically by our cleanup process within the configured retention period (60 minutes). See our Privacy Policy for full details.

Support

Frequently Asked Questions

Why is SVG riskier than JPG or PNG?

JPG and PNG are opaque pixel data with no behavior of their own. SVG is plain XML text that browsers can execute as part of the page — it can contain <script> elements, on* event-handler attributes (like onload or onclick), and references to external resources, any of which can run or fire when the file is embedded directly (inline, or via an <img>/<object> tag that allows scripting) rather than just displayed as a picture.

Does this tool fix or clean the SVG for me?

No — this is a diagnostic scanner only. It reports every risky construct it finds with a plain-language explanation, but it does not modify, strip, or convert the file. To use a flagged file safely, remove the specific elements/attributes it identifies, or convert it to a raster format with this site's <a href="/svg-to-png/">SVG to PNG</a> tool, which independently sanitizes and rejects unsafe SVG content as part of the conversion.

What does it check for exactly?

<script> and <foreignObject> elements (which can run or embed arbitrary script/HTML), on* event-handler attributes, references to external resources in href/xlink:href/src attributes or CSS url(...) values (which can be used for tracking or loading unexpected content), a DOCTYPE/ENTITY declaration (a classic XML entity-expansion attack vector), and an implausibly large declared canvas size.

What happens if the SVG has a DOCTYPE or ENTITY declaration?

The scan stops there and reports it as a single critical finding, rather than attempting to parse the rest of the file — a DOCTYPE/ENTITY declaration is the classic XML External Entity (XXE) / "billion laughs" attack vector, so this tool never risks fully parsing one just to report on what else the file contains.

Is my SVG kept on your server?

No. This is a report-only tool — no output file is created, and your uploaded SVG is deleted automatically shortly after the scan runs.

Keep Going

Related Tools