Convert Markdown to HTML

The question every Markdown to HTML converter has to answer

Markdown allows raw HTML. That single sentence from the original 2004 specification is why no two converters behave the same, and it is the only decision on this page that can actually hurt you. John Gruber's rule was that any block of HTML in a Markdown document passes through untouched, because he was writing for people publishing their own weblogs. Twenty years later most Markdown is not written by the person converting it. It is a README pulled from a repository, a comment from an issue tracker, a description field from a CMS, a message from a chat export, or output from a language model that was itself fed untrusted text.

If that Markdown reaches a converter that passes HTML through, and the result is placed on a page, then <img src=x onerror=alert(document.cookie)> in the source becomes running JavaScript on your site. It does not need a<script> tag. It does not need the user to click anything. This is the most common cross-site scripting hole in content-driven applications, and it is created by a default, not by a bug.

So this converter escapes raw HTML unless you say otherwise. Escaping means<b> comes out as <b> and renders as the literal characters a reader can see. Nothing is lost — you can read exactly what the document contained — and nothing executes. The two other modes are one click away and they are honest about what they do. Pass through emits your tags verbatim, which is the right answer when the Markdown is yours. Removedeletes the tags and keeps the words between them, with one exception: the contents of<script> and <style> are removed too, because leaving alert(1) sitting in a paragraph as body text helps nobody.

Link destinations are the other half of the problem

Escaping tags is not enough on its own, and this is where a surprising number of converters stop. [click me](javascript:alert(1)) contains no HTML at all. It is ordinary Markdown link syntax, and a converter that only worries about tags will happily produce an anchor whose href runs code the moment somebody clicks it. Every destination here is normalised — control characters stripped, character entities decoded — and then checked against a list of schemes that are allowed rather than a list that is forbidden. Relative paths, anchors, http, https, mailto and tel go through. Anything else keeps its text and loses its link, and the receipt tells you which URL was blocked instead of quietly dropping it.

Which flavor of Markdown this is

There is no such thing as plain Markdown any more. CommonMark pinned down the ambiguities in the original description; GitHub Flavored Markdown added tables, strikethrough, task lists and automatic linking of bare URLs on top of it; and then Kramdown, Python-Markdown, MultiMarkdown and Pandoc each added footnotes, definition lists, heading attributes and math in their own incompatible syntaxes. A file that renders perfectly on GitHub can lose half its structure somewhere else.

This tool implements a CommonMark subset plus the four GitHub extensions people actually depend on, and prints the full list above the fold. Tables work, including alignment markers and empty cells. Nested lists work, ordered inside unordered and three levels deep. Fenced code blocks keep their language as aclass="language-…" attribute so a highlighter can pick it up later, and a fence of four backticks will happily contain a fence of three. Footnotes, definition lists, custom heading IDs and math are not implemented — and when your input contains one, the tool names it on the receipt rather than letting you discover the gap in production.

Preview and source, not one or the other

A converter that only gives you HTML text forces you to paste that text somewhere else to find out whether it came out right. A converter that only gives you a preview hides whether the markup is clean. Both are here, one click apart, generated from the same conversion. When raw HTML is set to pass through, the preview runs inside a sandboxed frame with scripts disabled — you asked for your HTML untouched, so you get to see it rendered, but it still cannot execute anything.

The output shape is yours to pick. A fragment is just the elements: drop it into a template, a CMS field, an email body or a component and let the surrounding page style it. A full document adds the doctype, the character-set declaration, a viewport meta tag and roughly ten lines of styling, so the downloaded file opens in a browser and already looks like a page — readable measure, code blocks with a background, tables with borders.

Nothing leaves this tab

The converter is a few kilobytes of JavaScript running in the page you are looking at. There is no upload endpoint, so there is nowhere for your document to go. That matters more than it sounds for this format specifically: the Markdown people need to convert is frequently internal documentation, unreleased release notes, meeting notes, or draft posts that are not supposed to exist publicly yet. You can confirm the claim yourself — open your browser's Network tab, then paste. No request appears.