Rich text editor for ASP.NET Core
A modern editor in the browser, and a .NET back end on your server that stores uploads safely, browses your image folders, follows your authorization policies and cleans the HTML before you save it. Add it with one NuGet package and one Tag Helper.
No Node build step and no separate upload service. Self-hosted, with a one-time purchase and perpetual licenses.
// Program.cs builder.Services.AddRichTextBox(); app.MapRichTextBoxUploads(); // uploads + gallery <!-- Edit.cshtml --> <form method="post"> <richtextbox asp-for="Body"></richtextbox> </form> // Edit.cshtml.cs: cleaned during model binding [RichTextHtml, BindProperty] public string Body { get; set; } = "";
in Program.cs for uploads and the gallery
one interface for any file store
location data removed from photos by default
interface languages
A JavaScript editor can only ask your server to store a file. Everything that decides whether your site is safe happens on the server. RichTextBox does that work in .NET, so you do not have to write it.
Extensions come from an allow-list, and the file's real type is read from its bytes. Sizes are limited, oversized images are refused before decoding, and SVG is off by default. Photos lose their EXIF, GPS and camera data. See it work
Users browse folders, create folders and upload from inside the editor. Files go to local disk by default. Register your own IRichTextBoxUploadStore for S3, Azure Blob or Cloudinary, and the gallery can browse it too. Upload providers
Every editor endpoint is an ordinary ASP.NET Core endpoint. Add RequireAuthorization("Editors") and RequireRateLimiting with the same conventions you already use. Security
Anyone can post to your page without the editor. [RichTextHtml] cleans the value on the server with the editor's own rules and validates its length, so your action receives safe HTML. Model binding demo
DOCX export and import have their own endpoints, built on the Open XML SDK, so documents stay on your server. Word documents
AI requests go through a resolver you register in dependency injection. The browser talks to your application, and never sees a provider key. AI demo
No separate service and no second permission system. One call returns the endpoint group, and the conventions you know apply to all of it.
RichTextBoxasp-forAddRichTextBox, stores through dependency injectionapp.MapRichTextBoxUploads() .RequireAuthorization("Editors") .RequireRateLimiting("editor"); builder.Services.AddRichTextBox(options => { options.MaxUploadBytes = 8 * 1024 * 1024; options.StripImageMetadata = true; // the default });
One problem per page: how to add a feature in ASP.NET Core, what the server does about it, and what to watch out for.
The browser side is RichTextEditor, the same engine as the JavaScript edition, delivered by the NuGet package as static web assets.
Keeps headings, lists, tables and pictures; drops the clutter.
Merge and split cells, resize columns, move rows, captions and header cells.
Upload, paste or drag in; resize, align, caption, alt text and a built-in image editor.
Real .docx export and import, and PDF export from the toolbar.
Suggesting mode with accept and reject, comment threads and revision history.
Finds missing alt text, empty headings, low contrast and more, with one-click repairs.
Type Markdown shortcuts as you write, or import and export Markdown.
Every toolbar control reachable from the keyboard, with labelled dialogs.
The interface in your users' language, right-to-left included.
The package targets .NET 8 and works with Razor Pages and MVC. See the requirements.
On local disk by default, under the folder you configure. Implement IRichTextBoxUploadStore to use cloud storage, and IRichTextBoxUploadBrowser on the same class so the gallery can browse it.
Put [RichTextHtml] on the property, or call IRichTextBoxHtmlSanitizer yourself. It removes scripts, event handlers and script URLs on the server.
With your own ASP.NET Core policies on the group that MapRichTextBoxUploads() returns. Add it before going live: without it, anyone who can reach the site can upload and browse the gallery.
No. The endpoints run inside your application, and the default upload store uses the file system.
A one-time purchase with perpetual licenses: per domain, per IP, 10 domains, developer, team, enterprise, redistribution or source code. See pricing.
Try every feature on the live demos, or install the package and run it in your own application.