Markdown to HTML Converter
Convert Markdown into a reusable HTML fragment or full document with flavor selection, raw-HTML controls and a sanitized local preview.{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }} {{ flavorLabel }} {{ safetyLabel }} {{ scopeLabel }}
{{ computation.ok ? computation.values.html_document : '' }}
| Check | Value | Detail | Copy |
|---|---|---|---|
| {{ row.label }} | {{ row.value }} | {{ row.detail }} |
{{ exportStatus }}
Markdown becomes consequential when it leaves a text editor and is treated as HTML. A heading, link, task list, or fenced code block has to be parsed into elements with explicit structure. The chosen parser rules determine which structures appear, while the publishing context determines which HTML is safe to keep.
There is no single Markdown dialect. CommonMark defines a portable core for paragraphs, emphasis, headings, lists, links, code, and related syntax. GitHub Flavored Markdown adds widely used behavior such as tables, task-list items, strikethrough, and automatic link handling. A document written for one flavor can render differently under another even when the source looks reasonable.
| Decision | What changes | Common reason |
|---|---|---|
| Markdown flavor | Which source patterns become HTML structures | Match the editor, repository, or CMS that produced the Markdown. |
| Raw HTML policy | Whether embedded tags are sanitized, escaped, removed, or retained | Separate untrusted publishing from trusted authoring. |
| External-link policy | Whether HTTP and HTTPS links retain anchors, open safely, gain nofollow, or become text | Meet the destination's security and editorial rules. |
| Output scope | Reusable fragment or complete document | Fragments fit an existing page; documents need their own head and body. |
Raw HTML creates the largest trust boundary. Markdown parsers may pass tags and attributes through to the result. Sanitization removes known-dangerous markup, while escaping turns tags into visible text and stripping removes the tags before parsing. Keeping raw HTML is appropriate only when every source author and every pasted fragment is trusted.
A preview is useful for checking structure, but it is not proof that generated code is safe in every destination. A CMS can apply its own sanitizer, scripts can enter later, and site CSS can change layout. Review the actual HTML artifact and test it under the same policy as the page that will publish it.
How to Use This Tool:
Match the source dialect and the destination's trust policy before converting the document.
- Choose Markdown flavor. Use GitHub Flavored Markdown for tables, task lists, and strikethrough, or CommonMark core for a narrower portable syntax.
- Set Raw HTML policy and External links. Keep the sanitizing default for untrusted or mixed-source text; use escape or strip when raw tags should not survive; keep trusted raw HTML only after reviewing the source.
- Choose an HTML fragment or full document, then paste Markdown or load one local MD, Markdown, or text file. Pretty output aids review, while compact output removes whitespace between tags.
- Compare HTML markup with Safe preview, then check the parser profile and warning notes. A fallback-parser warning means only a limited Markdown subset was available for that run.
Interpreting Results:
The HTML markup is the artifact that will be copied or downloaded. The preview is intentionally stricter: it is sanitized again, rendered in a sandbox, converts task-list inputs to plain checkbox symbols, and removes clickable link behavior. A clean preview therefore does not guarantee that Keep trusted raw HTML produced a safe code artifact.
The structure profile counts headings, paragraphs, list items, table rows, code blocks, links, and media. Use those counts to spot a missing table or code fence, not as a quality score. The conversion ledger identifies the active parser, source size, raw-HTML policy, external-link policy, output shape, and review notes.
When the source and destination support different Markdown flavors, compare the structures that matter rather than only the visible prose. Tables, task lists, soft line breaks, raw HTML, and heading IDs are common places for a conversion to be syntactically valid but editorially wrong.
Technical Details:
The conversion is an ordered text transformation. Parser output is only the middle of the process: raw-HTML handling happens before or after parsing according to policy, link and heading rules modify the fragment, and full-document wrapping happens last.
Transformation Core:
| Stage | Transformation | Why order matters |
|---|---|---|
| Normalize source | Remove a leading byte-order mark or selected zero-width marks and normalize line endings. | Parser input becomes consistent across pasted and local files. |
| Handle raw tags | Escape or remove raw tags before parsing, or pass them through for later sanitizing or trusted retention. | Preprocessing determines whether a tag remains markup or becomes text. |
| Parse Markdown | Apply the selected GitHub-flavored or CommonMark-core profile. | Tables, task lists, strikethrough, and soft breaks depend on parser options. |
| Apply safety policy | Sanitize generated HTML when requested; otherwise retain the selected raw-tag treatment. | Keeping raw HTML preserves active markup in the code artifact. |
| Rewrite fragment | Add unique heading IDs when requested, apply the external-link policy, then pretty-print or compact the markup. | Later rules operate on generated HTML rather than Markdown text. |
| Shape output | Return the fragment or place it in a complete HTML document with optional readable CSS. | Document CSS has no effect on fragment output. |
| Build preview | Sanitize the final fragment again and neutralize links and form controls for sandboxed display. | The preview remains safer than a retained-HTML artifact. |
Rule Core:
| Policy | Exact effect | Important limit |
|---|---|---|
| Sanitize generated HTML | Parse raw tags, then remove or rewrite unsafe elements and attributes. | Sanitization reduces known risks but does not replace the destination's own policy. |
| Escape raw HTML | Encode tag characters before Markdown parsing so the tag appears as text. | Text that merely resembles a tag may also be escaped. |
| Strip raw HTML tags | Remove matched tags before parsing while leaving surrounding text. | Removing tags can join content or discard intended structure. |
| Keep trusted raw HTML | Retain parsed raw HTML in the code artifact. | The preview is still sanitized and cannot validate the retained markup. |
| Open external links safely | Add target="_blank" with noopener noreferrer to HTTP and HTTPS anchors. | Non-HTTP link schemes are not rewritten by this rule. |
| Safe links plus nofollow | Add the safe-new-tab attributes and nofollow. | The attribute is an editorial signal, not a malware check. |
| Convert external links to text | Remove the anchor while keeping its visible content. | The destination URL is no longer clickable in the artifact. |
Heading IDs are derived from lowercase heading text, with accents decomposed, non-alphanumeric runs changed to hyphens, and duplicates numbered from the second occurrence. Pretty formatting inserts line breaks between adjacent tags; compact formatting removes whitespace between tags. Neither option changes the intended element tree.
Pasted source is limited to 100,000 characters and a local file to 2 MiB. When the primary parser is unavailable, a built-in fallback covers headings, paragraphs, emphasis, links, images, fenced code, block quotes, lists, horizontal rules, and a limited GitHub-style table and task-list subset; the result carries a warning because parity is not guaranteed.
Security and Privacy Notes:
Markdown source and local files are processed in the browser. The generated HTML can still disclose source content or become active content after it is pasted into another system.
- Keep sanitization enabled for untrusted Markdown and apply the destination's sanitizer again at publish time.
- Use Keep trusted raw HTML only when every embedded tag and attribute has been reviewed.
- Inspect generated URLs and media sources separately; conversion does not verify that destinations are trustworthy or available.
References:
- CommonMark Specification 0.31.2, CommonMark, January 2024.
- GitHub Flavored Markdown Specification 0.29-gfm, GitHub, April 2019.
- Cross Site Scripting, OWASP Foundation.
- HTML Standard: Links, WHATWG.