The workshop · Markdown to HTML
How it works : Markdown to HTML
Every HTML character in your text is ESCAPED, no exceptions: a script written into your Markdown comes out visible, never runnable. That is stricter than the specification, and it is the only safe behaviour for a tool producing a file somebody is going to open.
This tool's promise is cut down, and it is written out: the reference specification for Markdown carries more than five hundred conformance examples. We do not implement five hundred. We implement the subset people actually write, and the page lists it construction by construction, so you know before pasting what will be converted and what will not.
On security, a point of doctrine worth getting right. The specification ALLOWS raw HTML inside a Markdown document, and we checked in its text that it asks implementations NOWHERE to sanitise their output: the instruction “run the result through a sanitiser” comes from the documentation of certain libraries, not from the standard. So we will not attribute it to the standard.
Our choice is simpler and stricter: every HTML character in your text is escaped. A tag written into your Markdown comes out VISIBLE in the result, never active. And dangerous link addresses are refused by name, with the link kept as plain text and reported on screen, in line with the public recommendation to allow only http and https addresses in an address attribute.
How it works
- Paste your Markdown. It does not leave your device.
- Tick “complete page” if you want a standalone HTML file rather than a fragment to insert.
- Copy or download the result. If any addresses were refused, the table names them.
Formats accepted
The subset converted: hash headings and underlined headings, paragraphs, bold, italic, strikethrough, inline code, fenced code blocks with their language, bulleted and numbered lists, nested block quotes, horizontal rules, links and images with their title, and the hard line break from two trailing spaces. Tables, footnotes and definition lists are NOT converted: they do not belong to the base specification.
Text in Markdown format
Up to 200,000 characters. The result comes out as HTML, either a fragment or a standalone page.
Its limits
A SUBSET of the specification, listed above
The reference specification carries more than five hundred conformance examples, many of them covering cases nobody ever writes: four level nested lists with continuation, link references defined further down, numeric HTML entities. Implementing and CHECKING five hundred cases would be a project of its own. We would rather announce precisely what works: it is a smaller promise, and it is kept.
HTML written into your Markdown is ESCAPED, never copied through
The specification allows it, but a tool producing an HTML file meant to be opened has to choose safety: a script slipped into a Markdown received from someone else would run. Every HTML character therefore becomes visible text. A consequence to know about: if you were deliberately using a tag for a particular effect, it will appear in plain sight in the result, and that is intended.
Only http, https, mailto and relative addresses are kept
A Markdown link can carry any address scheme at all, including ones that run code on click. The public OWASP recommendations on scripts injected into a page say to allow only http and https in an address attribute. The tool follows that rule, keeps the link's text, and REPORTS the refused address in a table: removing it in silence would let you believe the link works.
Tables are not converted
The pipe table syntax is a very widespread extension, but it does not belong to the base specification: every implementation handles it slightly differently, particularly on alignment and empty cells. We do not implement it rather than return a table that differs from the one your usual platform produces.
Questions about this tool
Is my text sent anywhere?
No. Check it in thirty seconds: open the inspector with the F12 key, the “Network” tab, clear the list, then paste your Markdown and convert. Not one line appears. Cut your connection and do it again: the parser is written in the page.
Why does my HTML tag appear in plain sight in the result?
Because every HTML character in your text is escaped, without exception. The Markdown specification allows raw HTML, but a tool producing a file meant to be opened by someone cannot copy through a tag from a text it did not write: a script slipped into a document you received would run. If you need a particular tag, add it after conversion, in your editor, knowing what you are doing.
One of my links is no longer clickable.
That means its address uses a scheme which allows code to run on click. The tool keeps the link's text, strips the address, and NAMES it in a table. If that link came from a document you did not write yourself, that is information to take seriously. The addresses kept are http, https, mailto, anchors and relative addresses.
My tables are not converted.
No, and it is written in the limits. The pipe table syntax is a very widespread extension but absent from the base specification, and every implementation handles it differently on alignment and empty cells. Returning a table that does not look like the one from your usual platform would be worse than saying plainly that we do not do it.
Is the result conformant to the specification?
On the subset we announce, it follows its rules, including the ones people often forget: the hard line break from two trailing spaces, inline code protecting its contents from any other interpretation, block quotes nesting. On everything else we claim nothing: the specification carries more than five hundred conformance examples, and we have not exercised them all. That is why the list of what works is written at the top of the page instead of a conformance badge.
Every HTML character in your text is ESCAPED, no exceptions: a script written into your Markdown comes out visible, never runnable. That is stricter than the specification, and it is the only safe behaviour for a tool producing a file somebody is going to open.
VerifyThe proof, step by stepThe network inspector check, explained one gesture at a time, with screenshots.
The cornerThe text and data cornerCount, compare, format, clean. The small jobs that cost an hour when you do not have them at hand.