diff --git a/js/privatebin.js b/js/privatebin.js
index 1170804..6826da4 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -408,7 +408,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                 DOMPurify.sanitize(
                     element.html().replace(
                         /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
-                        '<a href="$1" rel="nofollow">$1</a>'
+                        '<a href="$1" rel="nofollow noopener noreferrer">$1</a>'
                     )
                 )
             );
diff --git a/js/test/Helper.js b/js/test/Helper.js
index f58d73a..2382c83 100644
--- a/js/test/Helper.js
+++ b/js/test/Helper.js
@@ -125,7 +125,7 @@ describe('Helper', function () {
                 let result = e.html();
                 clean();
                 url = $('<div />').text(url).html();
-                return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + $('<div />').text(postfix).html() === result;
+                return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow noopener noreferrer">' + url + '</a>' + $('<div />').text(postfix).html() === result;
             }
         );
         jsc.property(
@@ -145,7 +145,7 @@ describe('Helper', function () {
                 let result = e.html();
                 clean();
                 url = $('<div />').text(url).html();
-                return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow">' + url + '</a>' + $('<div />').text(postfix).html() === result;
+                return $('<div />').text(prefix).html() + '<a href="' + url + '" rel="nofollow noopener noreferrer">' + url + '</a>' + $('<div />').text(postfix).html() === result;
             }
         );
     });