Markdown to HTML

Markdown is a writing format; HTML is what a browser renders. Every Markdown tool converts between them, and the differences are all in the details: which extensions are supported, what happens to raw HTML, and whether the headings come out with the ids the rest of your document links to.

This converter handles CommonMark plus the three GitHub extensions people write without thinking about — tables, strikethrough and task lists — and shows the result live beside the source. The HTML panel and the preview are the same markup, so what you see is what you copy.

The output is sanitised. That matters more than it sounds: Markdown deliberately allows raw HTML to pass through, so any converter that does not strip scripts and event handlers is a way to move someone else's JavaScript onto your site.

The CommonMark core: ATX and setext headings, paragraphs, hard and soft line breaks, emphasis and strong emphasis with both asterisks and underscores, inline code and fenced or indented code blocks, blockquotes with lazy continuation, ordered and unordered lists nested to any depth, thematic breaks, backslash escapes, HTML entities, autolinks, images, and links in inline, reference and shortcut form.

On top of that: pipe tables with per-column alignment, ~~strikethrough~~, and task lists, where - [ ] and - [x] become real checkboxes. Fenced blocks keep their info string as a language- class, so a syntax highlighter on your own page can pick it up.

Footnotes, definition lists, front matter and math blocks are not implemented. Nothing is silently swallowed — anything the parser does not recognise as syntax comes through as literal text, so an unsupported construct shows up in the output where you can see it.

Raw HTML in a Markdown document is not a bug in the format, it is a feature of it, and it means a converter is an HTML pass-through unless something stops it. A README that contains an image tag with an onerror attribute produces HTML with that attribute intact, and the moment that HTML lands on a page, the script runs with your site's origin and your visitors' cookies.

The filter here works from an allow-list and rebuilds every tag it keeps from a parsed name and a filtered attribute list, rather than trying to delete the dangerous parts of the original text. Script, style, iframe, object, form and svg elements are removed along with their contents; every attribute that is not on the permitted list goes, which covers onclick, onerror, onmouseover, srcdoc, formaction and whatever the next one turns out to be called.

URLs get their own check. The value is entity-decoded and stripped of the whitespace a browser ignores before its scheme is read, because java	script: and javascript: both run perfectly well and both defeat a naive check on the raw text. Only http, https, mailto, tel, ftp, sms and relative URLs survive, plus base64 raster images on an img tag.

A heading becomes an id by GitHub's rule: take its rendered text, lower-case it, drop punctuation and symbols apart from hyphens and underscores, and turn each run of whitespace into a single hyphen. Repeated headings get -1, -2 and so on appended in document order.

Matching that rule matters more than improving on it. Existing documents are full of anchors written against GitHub's output — a table of contents at the top of a README is a page of them — and a cleverer slug quietly breaks every one. The list of generated anchors under the output is there so you can check before you publish.

Usually into a CMS field, an email template, or a page that has no Markdown pipeline of its own. All three want plain semantic HTML with no classes and no framework attached, which is what comes out here: h2, p, ul, table, pre — the tags, and nothing else.

The one class emitted is language- on a fenced code block, because dropping it would lose the language you wrote and every highlighter reads it. Task lists also carry the two class names GitHub uses, so existing checkbox styling applies to them without changes.