About
DNS tools should show their work.
CleanWeb is an independent, account-free tool for people who want a filtering file they can inspect before trusting it with their network.
Why it exists
The hard part is not downloading a blocklist.
It is knowing which list was used, whether its license allows the use, whether the syntax matches the software, and whether the update changed what you expected. Many tools hide those details behind an import button.
CleanWeb makes those details part of the artifact. Source names, links, license notes, snapshot limits, generation time, and a self-check all travel with the file. The validator and diff tools expose the same information for lists you already have.
The working model
01Curated source snapshot
A maintainer checks upstream license and availability, then records bounded category samples with checksums.
02Browser-side composition
Your browser loads those same-origin snapshots, verifies them, removes duplicates, and emits only the chosen target syntax.
03Inspectable output
The generated file is re-parsed by the same validator before it can be downloaded. Source and limitation notes are in the header.
Principles
Opinionated about the right things.
Local first
Rule parsing and generation happen in the browser. There is no account, no upload endpoint, and no analytics SDK to leak a file.
Evidence over reassurance
The product shows source URLs, licenses, snapshots, and limitations. It does not promise complete protection or rely on invented numbers.
Format correctness
Each target receives its own syntax. Hosts mappings, Pi-hole domains, and AdGuard rules are not concatenated into a single ambiguous file.
Fail visibly
Missing sources, failed checksums, oversized files, invalid hostnames, and unsupported syntax produce explicit errors instead of silent guesses.
What this is
A configurator, checker, and comparator.
- A generator for bounded, licensed DNS filter snapshots in three explicit formats.
- A local validator for hostnames, duplicates, blank lines, conflicts, and unsupported syntax.
- A diff tool that normalizes rules across formats so a replacement can be reviewed.
- Documentation that describes installation paths and platform limitations in plain language.
What this is not
Not a resolver, not a guarantee.
- Not a public DNS service. It generates files for software you run.
- Not a complete mirror of every upstream blocklist. The category snapshots are explicitly bounded.
- Not an antivirus or a content scanner. DNS cannot see inside encrypted traffic.
- Not a commitment that a domain is safe or unsafe. It records a source's technical filtering decision.
Security boundaries
Small surface, stated limits.
The current app has no server-side API that accepts user input. Inputs are bounded to 1 MiB and 50,000 lines, each line is length-limited, and uploads are treated as text, never code. Source snapshots are verified with Web Crypto where the browser exposes it. Production responses set a restrictive content security policy and other browser security headers.
Current implementation
What it cannot solve
If server-side URL checking is added later, it must be designed to resist SSRF: protocol allowlisting, private-address and metadata-endpoint blocking, DNS rebinding defenses, redirect and response-size limits, and strict timeouts. That functionality is not present in this version.
Licensing
CleanWeb's source code is licensed under the MIT license. Bundled rule snapshots come from The Block List Project, whose repository declares the Unlicense and whose list headers sometimes state MIT. Both are permissive. The exact source metadata is shown for every category.
CleanWeb is not affiliated with AdGuard, Pi-hole, or The Block List Project. No generated file includes a warranty or a guarantee of completeness.
Start with a file you can explain.
Make three choices, inspect the header, check the output, then install it with the matching guide.