Markdown to HTML Converter

Markdown is a plain-text formatting syntax created by John Gruber and Aaron Swartz in 2004. The goal was a writing format that looks readable as source (no angle brackets, no closing tags) and converts cleanly to HTML. You write a heading as '# Title', a link as '[text](url)', and a bold word as '**word**', and a converter turns the source into the equivalent HTML tags. Markdown now powers GitHub READMEs, Reddit comments, Discord messages, Stack Overflow posts, static-site generators, and most documentation tooling, which is why every developer and writer eventually meets it.

The original Markdown is Gruber's 2004 spec, which leaves several edge cases (nested lists, hard line breaks, embedded HTML) open to interpretation, so different parsers produce different output for the same input. CommonMark is a 2014 standardisation effort that pins every ambiguity down with a formal spec, so any compliant parser produces identical output. GitHub Flavored Markdown (GFM) is CommonMark plus a few practical extensions: fenced code blocks with language hints, tables, task lists, autolinks, and strikethrough. This converter sticks to the Gruber subset plus fenced code blocks, which covers most real-world paste-and-convert needs; full CommonMark or GFM features like tables and task lists are not implemented.

A link like [click](javascript:alert(1)) would render in HTML as an anchor that runs script when clicked, which is the classic stored-XSS attack vector for any tool that lets a user submit Markdown and renders the result. We allow only http, https, mailto, tel, and schemeless (relative) URLs in links and images; anything else (javascript:, data:, vbscript:, file:, and unknown schemes) is rewritten to '#' and tagged with rel='nofollow'. The scheme check is case-insensitive, so JAVASCRIPT: is rejected the same way as javascript:. If you need to allow custom schemes, run the source through a different tool you trust to handle them.

Headings (# through ######), paragraphs separated by blank lines, bold (**text** or __text__), italic (*text* or _text_), inline code (`code`), fenced code blocks (```lang ... ```), links and images with optional titles, unordered lists (- or *), ordered lists (1.), blockquotes (> text), horizontal rules (---), and hard line breaks (two trailing spaces). Not supported: tables, task lists, footnotes, definition lists, autolinks, strikethrough, nested lists beyond a single level, and inline HTML pass-through. Code blocks always escape HTML so '<script>' shows as text, and a 'sanitize HTML' toggle (on by default) escapes raw HTML everywhere else too.

Use a full parser when you need GitHub-style tables, task lists, footnotes, syntax-highlighted code blocks, raw HTML pass-through, or strict CommonMark compliance for content that will be diffed against other CommonMark output. The two reliable JavaScript choices are marked (small, fast, GFM by default) and markdown-it (more configurable, full CommonMark plus a plugin ecosystem). Both have proper test suites against the CommonMark spec and handle every edge case that this lightweight converter skips. The trade-off is bundle size: marked adds about 30 KB gzipped, markdown-it about 40 KB; this tool ships zero parser code because the regex pipeline lives in one file under 500 lines.