Convert Markdown to HTML

The question every Markdown to HTML converter has to answer

Markdown allows raw HTML. That single sentence from the original 2004 specification is why no two converters behave the same, and it is the only decision on this page that can actually hurt you. John Gruber's rule was that any block of HTML in a Markdown document passes through untouched, because he was writing for people publishing their own weblogs. Twenty years later most Markdown is not written by the person converting it. It is a README pulled from a repository, a comment from an issue tracker, a description field from a CMS, a message from a chat export, or output from a language model that was itself fed untrusted text.

If that Markdown reaches a converter that passes HTML through, and the result is placed on a page, then <img src=x onerror=alert(document.cookie)> in the source becomes running JavaScript on your site. It does not need a <script> tag. It does not need the user to click anything. This is the most common cross-site scripting hole in content-driven applications, and it is created by a default, not by a bug.

So this converter escapes raw HTML unless you say otherwise. Escaping means <b> comes out as <b> and renders as the literal characters a reader can see. Nothing is lost — you can read exactly what the document contained — and nothing executes. The two other modes are one click away and they are honest about what they do. Pass through emits your tags verbatim, which is the right answer when the Markdown is yours. Remove deletes the tags and keeps the words between them, with one exception: the contents of <script> and <style> are removed too, because leaving alert(1) sitting in a paragraph as body text helps nobody.

Markdown and HTML, in brief

Markdown

Full name	Markdown
Extension	.md, .markdown
Format type	Plain text with lightweight formatting
MIME type	text/markdown

HTML

Full name	HyperText Markup Language
Extension	.html, .htm
Format type	Markup document
MIME type	text/html

Link destinations are the other half of the problem

Escaping tags is not enough on its own, and this is where a surprising number of converters stop. [click me](javascript:alert(1)) contains no HTML at all. It is ordinary Markdown link syntax, and a converter that only worries about tags will happily produce an anchor whose href runs code the moment somebody clicks it. Every destination here is normalized — control characters stripped, character entities decoded — and then checked against a list of schemes that are allowed rather than a list that is forbidden. Relative paths and anchors go through, as do http, https, mailto, tel, ftp, ftps, irc, news, nntp, sms, xmpp, magnet and bitcoin links. Other schemes keep their text and lose their link, and the receipt tells you which URL was blocked instead of quietly dropping it.

Which flavor of Markdown this is

There is no such thing as plain Markdown any more. CommonMark pinned down the ambiguities in the original description; GitHub Flavored Markdown added tables, strikethrough, task lists and automatic linking of bare URLs on top of it; and then Kramdown, Python-Markdown, MultiMarkdown and Pandoc each added footnotes, definition lists, heading attributes and math in their own incompatible syntaxes. A file that renders perfectly on GitHub can lose half its structure somewhere else.

This tool implements a CommonMark subset plus the four GitHub extensions people actually depend on, and prints the full list in the tool. Tables work, including alignment markers and empty cells. Nested lists work, ordered inside unordered and three levels deep. Fenced code blocks keep their language as a class="language-…" attribute so a highlighter can pick it up later, and a fence of four backticks will happily contain a fence of three. Footnotes, definition lists, custom heading IDs and math are not implemented — and when your input contains one, the tool names it on the receipt rather than letting you discover the gap in production.

Preview and source, not one or the other

A converter that only gives you HTML text forces you to paste that text somewhere else to find out whether it came out right. A converter that only gives you a preview hides whether the markup is clean. Both are here, one click apart, generated from the same conversion. Images stay in the HTML with their exact paths, while the preview shows a placeholder such as [image: logo] instead of fetching anything. Every heading gets a GitHub-style id, so a table of contents that links to #setup keeps working, and the receipt counts any internal link whose target is missing. When raw HTML is set to pass through, the preview runs inside a sandboxed frame with scripts disabled — you asked for your HTML untouched, so you get to see it rendered, but it still cannot execute anything.

The output shape is yours to pick. A fragment is just the elements: drop it into a template, a CMS field, an email body or a component and let the surrounding page style it. A full document adds the doctype, the character-set declaration, a viewport meta tag and roughly ten lines of styling, so the downloaded file opens in a browser and already looks like a page — readable measure, code blocks with a background, tables with borders.

Neither shape is indented for reading. The generated markup follows the structure of your document rather than a house style, so a long table or a deeply nested list comes out as a wall of angle brackets that is fine for a machine and unpleasant for a person reviewing a diff. Running it through the HTML formatter afterwards puts it on separate lines without touching what any of it means. If the format itself is what is unfamiliar rather than the conversion, what an MD file is starts one step earlier.

If the source needs revision rather than conversion settings, open the Markdown editor first. Its Styled and Raw views change the Markdown itself; return here when the job is choosing HTML safety policy, previewing the result and copying or downloading the generated markup.

The reverse trip is a genuinely different problem rather than this one run backwards. Markdown holds deliberately less vocabulary than HTML, so HTML to Markdown keeps arriving at constructs with no destination — a merged table cell, a superscript, a definition list — and has to choose between keeping the original HTML and reducing the construct to plain text. Going this way never runs out of anywhere to put something, which is why that page has to report what it could not carry and this one has nothing to report.

Nothing leaves this tab

The converter is a few kilobytes of JavaScript running in the page you are looking at. There is no upload endpoint, so there is nowhere for your document to go. That matters more than it sounds for this format specifically: the Markdown people need to convert is frequently internal documentation, unreleased release notes, meeting notes, or draft posts that are not supposed to exist publicly yet. You can confirm the claim yourself — open your browser's Network tab, then paste. No document data leaves the tab, and the preview does not request the images your Markdown names.