Markdown to HTML
Convert Markdown to clean HTML, live. It supports full GitHub-Flavored Markdown — tables, task lists, fenced code and strikethrough — with a rendered preview and the HTML source side by side, plus copy and download. Every conversion is sanitized with DOMPurify, so the output is safe to paste anywhere. Everything runs in your browser; nothing is uploaded.
Your rendered HTML preview appears here…
Converted entirely in your browser — your content is never uploaded. The output is sanitized with DOMPurify (dangerous tags and event handlers removed), so it is safe to paste anywhere.
What this tool is
- A free, in-browser Markdown to HTML converter — paste or type Markdown on the left and the HTML renders live on the right, with no signup and nothing uploaded.
- Supports GitHub-Flavored Markdown: tables, task lists, fenced code blocks, strikethrough and autolinks, not just the basics.
- Two output views — a rendered Preview and the raw HTML Source — with one-click Copy and Download .html.
- Every conversion is sanitized with DOMPurify by default: <script> tags, inline event handlers (onerror, onclick) and javascript: URLs are stripped, so the HTML is safe to paste anywhere.
- Everything runs client-side using marked and DOMPurify — your content never leaves your browser, which makes it safe for internal docs, notes or anything sensitive.
What is Markdown, and how does it map to HTML?
Markdown is a plain-text way to write formatted documents. You use a handful of simple marks and a converter expands them into HTML — the markup browsers actually render. The raw text stays readable on its own, which is why Markdown is the default for README files, GitHub issues, docs sites and note apps. This converter targets GitHub-Flavored Markdown (GFM), the common superset used across GitHub and most tooling.
- Headings.
# Title→<h1>,## Section→<h2>, and so on through<h6>. - Emphasis.
**bold**→<strong>,*italic*→<em>, and GFM~~strike~~→<del>. - Lists.
- item→<ul><li>,1. item→<ol><li>, and GFM task lists- [x] donebecome checkboxes. - Links & images.
[text](url)→<a>and→<img>. - Code. Inline
`code`→<code>, and triple-backtick fences →<pre><code>blocks. - Tables. GFM pipe tables (
| a | b |) become full<table>markup with headers and alignment.
Why rendering Markdown safely needs sanitizing
Markdown is not a safe-by-default format. The spec permits raw HTML inside Markdown, so a document can contain a literal <script>tag, an <img onerror=…> handler, or a javascript: link. If you convert Markdown from an untrusted source — a comment, an uploaded file, an API response — and drop the result straight into a page, that embedded script runs in your users' browsers. This is one of the most common cross-site scripting (XSS) mistakes in apps that accept Markdown.
This tool defends against that by running every conversion through DOMPurify, a battle-tested HTML sanitizer, before anything is previewed, copied or downloaded. DOMPurify parses the HTML and removes dangerous constructs — <script>, inline event handlers like onerror and onclick, javascript: URLs, <iframe> and <object> — while keeping legitimate formatting intact. Sanitizing is on by default; you can toggle it off to inspect the raw converter output, but the tool warns you and you should only do so for Markdown you fully trust.
Security note: never render Markdown or HTML from an untrusted source without sanitizing it first. Converting is not the same as making content safe — the HTML this tool produces is sanitized with DOMPurify so you can paste it anywhere, but if you build your own Markdown pipeline, sanitize on the server (or in a trusted step) as well.
Frequently asked questions
What is Markdown?
Markdown is a lightweight plain-text formatting syntax created by John Gruber in 2004. Instead of HTML tags, you write readable shorthand — # for a heading, ** for bold, - for a list item, > for a quote, backticks for code — and a converter turns it into HTML. It is the default format for README files, GitHub issues and pull requests, documentation sites, static-site generators and most note-taking apps, because the raw text stays readable even before it is rendered. This tool accepts GitHub-Flavored Markdown (GFM), the widely used superset that adds tables, task lists, strikethrough and automatic links on top of the original spec.
Is the generated HTML safe / sanitized?
Yes. By default every conversion is passed through DOMPurify, a widely used, security-focused HTML sanitizer, before it is shown or copied. DOMPurify removes anything that could execute code or exfiltrate data — <script> tags, inline event-handler attributes such as onerror and onclick, javascript: URLs, <iframe>, <object> and similar — while keeping the ordinary formatting Markdown produces (headings, lists, tables, links, images, code blocks). This matters because Markdown can contain raw HTML, so converting untrusted Markdown without sanitizing is a classic cross-site-scripting (XSS) vector. You can turn sanitizing off to see the raw converter output, but the tool warns you clearly and you should only do that for input you fully control.
Is my content uploaded to a server?
No. All of the conversion, sanitizing, preview rendering and the copy/download actions happen entirely in your browser using JavaScript (the marked and DOMPurify libraries). Your Markdown and the resulting HTML are never sent to PlayCISO or any other server, and nothing is logged. That is why it is safe to convert internal documentation, meeting notes, draft content or anything else sensitive — it stays on your device. You can even disconnect from the network and the tool keeps working, which is a quick way to prove no upload is happening.
Does it support GitHub-Flavored Markdown (tables, task lists, code)?
Yes. The converter has GFM enabled, so pipe tables, task lists ([ ] and [x] checkboxes), fenced code blocks (``` fences), strikethrough (~~text~~) and automatic linking of bare URLs all work in addition to standard Markdown — headings, bold, italic, ordered and unordered lists, blockquotes, inline code, links and images. The Preview tab shows exactly how it renders and the HTML tab shows the exact markup produced, so you can copy whichever you need.