SVG viewer and inspector
Read an SVG's size and viewBox, and see whether it carries anything unsafe.
Processed in your browser. This file is converted on your device and is never uploaded.
Converter
.svg up to 50 MB. You can also drag a file here.
No file selected.
About this tool
Opening an unfamiliar SVG usually means answering two questions: what size is it actually, and does it contain anything it should not. An SVG can carry scripts, event handlers, and references that fetch from other sites, and none of that is visible when you look at the picture.
This tool reads the document, reports its declared width, height, and viewBox, counts its elements, and lists anything executable or externally-fetching it found. The download is a cleaned copy with that content removed.
Supported formats and limits
- Input
- .svg
- Output
- .svg (image/svg+xml)
- Output name
- The original name with -cleaned, for example logo.svg becomes logo-cleaned.svg.
- File size limit
- 50 MB
- Processing
- In your browser. The file is not uploaded.
How to use it
- Choose a .svg file, or paste the markup.
- Read the report and the preview.
- Select Convert to download the cleaned copy.
Limitations
- This reports what the document declares. An SVG with only a viewBox has no pixel size at all, which is exactly what the report will say.
- Only absolute pixel sizes are read. A width given as a percentage depends on a container that does not exist here, so it is reported as absent.
- The element count includes every node, not only visible shapes.
- The cleaned copy is not optimized. Use the optimizer or minifier for that.
Frequently asked questions
- Is my file uploaded?
- No. The file is parsed in your browser and never leaves your device.
- Why does it say my SVG has no width?
- Because it declares only a viewBox, or declares a percentage. Both are common in icon sets, and both mean the file has no intrinsic pixel size; whatever displays it decides how large it is.
- What counts as unsafe content?
- Script elements, event handler attributes such as onload, javascript: links, foreignObject blocks, and any reference that would fetch from another origin.
- Can I trust the cleaned copy?
- It has had everything executable and externally-fetching removed by a parser rather than by pattern matching. That is a much stronger position than the original, though nothing replaces knowing where a file came from.