Markdown to HTML converter

Markdown is a superset of HTML in practice: any raw tag in the source goes straight into the output. That is useful for <details> or <kbd>, and dangerous for anything users write, because <img src=x onerror="…"> runs JavaScript in every browser that shows it.

The marked library, which this tool uses, does not sanitize its output, and its docs say to run a sanitizer afterwards. With Sanitize on, the HTML goes through DOMPurify, which removes scripts, event handler attributes and javascript: URLs and keeps ordinary formatting. The tool lists what it removed. GitHub goes a step further and filters <title>, <textarea>, <style>, <xmp>, <iframe>, <noembed>, <noframes>, <script> and <plaintext> as part of the GFM spec.

If you convert Markdown on a server, sanitize there too. Cleaning only in the browser does not protect other places the HTML ends up, such as emails or RSS feeds.

JavaScript with marked, sanitized with DOMPurify. On Node.js, DOMPurify needs a DOM such as jsdom:

import { marked } from 'marked';
import DOMPurify from 'dompurify';

const html = DOMPurify.sanitize(marked.parse(markdown, { gfm: true }));

Command line with pandoc. Add -s for a full page with <head>:

pandoc -f gfm -t html README.md -o README.html
pandoc -s -f gfm -t html README.md -o page.html --metadata title="README"

Python with Python-Markdown. It follows the original Markdown rules, so tables and fenced code come from extensions:

import markdown

html = markdown.markdown(text, extensions=["tables", "fenced_code", "toc"])

Go with goldmark and its GFM extension:

var buf bytes.Buffer
md := goldmark.New(goldmark.WithExtensions(extension.GFM))
if err := md.Convert(source, &buf); err != nil { panic(err) }

• Lists right after a paragraph. In CommonMark a list can interrupt a paragraph, but an ordered list can only do so when it starts at 1. Leave a blank line before lists to be safe across renderers.
• Indentation inside lists. A nested list or a code block inside a list item must be indented to line up with the item’s text, not just by one space.
• Underscores in words. snake_case_name stays as text in CommonMark, because underscores inside a word do not start emphasis. Asterisks do: a*b*c makes the b italic.
• Going back. To turn HTML into Markdown, use the HTML to Markdown converter. To build a table first, use the Markdown table generator. To tidy the HTML, use the HTML formatter.

Picking a docs tool or a CMS? Browse documentation tools and CMS tools on DevHunt.