GitHub-flavored Markdown in, sanitized HTML out
A Markdown to HTML converter parses Markdown syntax — the lightweight formatting used in README files, documentation and chat — and emits the equivalent HTML elements, so the content can be published by a CMS or dropped into a template.
Markdown is a writing format; HTML is a publishing format. The conversion between them is well-defined for headings, lists and links, but two things vary between converters and both matter: which flavor of Markdown is supported, and what happens to raw HTML embedded in the source.
This converter uses GitHub-flavored Markdown and sanitizes its output before display or export. That second part is the important one if you are ever converting text you did not write yourself — and this page explains exactly why.
The specific behaviour of this converter
- Flavor
- GitHub-flavored Markdown, so tables, fenced code blocks, strikethrough, task lists and bare-URL autolinking all work as they do in a README.
- Line breaks
- Single newlines become <br> tags. This differs from strict CommonMark, where a single newline is treated as a space and two trailing spaces are required to force a break. It matches how chat apps and GitHub comments behave, which is what most people expect.
- Sanitization
- Output passes through a sanitizer before it is previewed or exported, removing script tags, event-handler attributes and javascript: URLs while leaving ordinary formatting intact.
- External links
- Links pointing off-site are given safe target and rel attributes, so an exported document does not hand window access to a third-party page.
- Where it runs
- Parsing and sanitizing happen in your browser. Draft documentation and unpublished notes are not uploaded anywhere.
- Output
- A rendered preview alongside the HTML source, with copy and download options for pasting into a CMS or committing to a repository.
How Markdown maps to HTML
Direct answer: each Markdown construct produces one predictable HTML element. Knowing the mapping tells you what your CSS will need to style.
Example 1: Structure and emphasis
## Setup
Install with **npm** or `yarn`.
- Node 18+
- A `.env` file<h2>Setup</h2>
<p>Install with <strong>npm</strong> or <code>yarn</code>.</p>
<ul>
<li>Node 18+</li>
<li>A <code>.env</code> file</li>
</ul>Note that ## produces an h2, not an h1. If your template already renders the page title as an h1, starting the body at h2 keeps the heading hierarchy valid — which matters for both accessibility and SEO.
Example 2: A GitHub-flavored table
| Plan | Price |
| --- | ----: |
| Free | 0 |
| Pro | 12 |<table>
<thead><tr><th>Plan</th><th align="right">Price</th></tr></thead>
<tbody>…</tbody>
</table>Tables are a GitHub extension, not part of original Markdown. The colon in the separator row sets column alignment — right-aligned here.
Example 3: Sanitization in action
Hello <img src=x onerror="alert(1)"> worldHello <img src="x"> worldThe event handler is stripped while the tag survives. If you paste Markdown from a form submission, a client or an AI assistant, this step is the difference between publishing content and publishing an injection.
Where conversions surprise people
Flavors genuinely differ
Tables, task lists, footnotes and strikethrough are extensions. A document that renders correctly on GitHub can lose half its formatting in a strict CommonMark renderer — check what your destination platform supports.
Indentation is significant
Nested lists need consistent indentation, and four spaces at the start of a line creates a code block. Mixed tabs and spaces are the usual reason a list renders as one paragraph.
Relative links break when the file moves
A README link to ./docs/setup.md works in the repository and 404s on your website. Rewrite relative links to absolute URLs before publishing.
Images are referenced, not embedded
Converting produces an img tag pointing at the original path. Upload the images and update the paths, then optimise them with the image compressor before publishing.
Your CMS may sanitize again — or double-escape
Pasting HTML into a rich-text editor can escape the tags so readers see the markup itself. Use the CMS’s HTML or code block mode, not the visual editor.
Never trust untrusted Markdown on the server
Sanitization here protects the preview and the export. If your application converts user-submitted Markdown, sanitize on the server as well — client-side sanitizing protects the client, not your database.
Taking a Markdown draft to a live page
- Start body content at h2 so the page keeps one h1 and a valid heading order.
- Convert relative links and image paths to absolute URLs.
- Check that code blocks kept their language hints if your site does syntax highlighting.
- Paste into the CMS in HTML mode, then preview before publishing.
- Confirm the draft length against your target with the word counter.
- Write the title, description and social tags for the published page with the meta tag generator.
How this page is maintained
The GitHub-flavored parsing, the single-newline line-break behaviour, the sanitization step and the safe external-link attributes were read from this converter’s implementation. The security note distinguishes client-side from server-side sanitizing because conflating the two is a genuine application-security mistake.
Written and reviewed by the ToolsRacks editorial team. Last reviewed: .