Markdown to HTML Converter

Markdown is a plain-text formatting syntax created by John Gruber and Aaron Swartz in 2004. The goal was a writing format that looks readable as source (no angle brackets, no closing tags) and converts cleanly to HTML. You write a heading as '# Title', a link as '[text](url)', and a bold word as '**word**', and a converter turns the source into the equivalent HTML tags. Markdown now powers GitHub READMEs, Reddit comments, Discord messages, Stack Overflow posts, static-site generators, and most documentation tooling, which is why every developer and writer eventually meets it.

The original Markdown is Gruber's 2004 spec, which leaves several edge cases (nested lists, hard line breaks, embedded HTML) open to interpretation, so different parsers produce different output for the same input. CommonMark is a 2014 standardization effort that pins every ambiguity down with a formal spec, so any compliant parser produces identical output. GitHub Flavored Markdown (GFM) is CommonMark plus a few practical extensions: fenced code blocks with language hints, tables, task lists, autolinks, and strikethrough. This converter sticks to the Gruber subset plus fenced code blocks, which covers most real-world paste-and-convert needs; full CommonMark or GFM features like tables and task lists are not implemented.

A link like [click](javascript:alert(1)) would render in HTML as an anchor that runs script when clicked, which is the classic stored-XSS attack vector for any tool that lets a user submit Markdown and renders the result. We allow only http, https, mailto, tel, and schemeless (relative) URLs in links and images; anything else (javascript:, data:, vbscript:, file:, and unknown schemes) is rewritten to '#' and tagged with rel='nofollow'. The scheme check is case-insensitive, so JAVASCRIPT: is rejected the same way as javascript:. If you need to allow custom schemes, run the source through a different tool you trust to handle them.

Headings (# through ######), paragraphs separated by blank lines, bold (**text** or __text__), italic (*text* or _text_), inline code (`code`), fenced code blocks (```lang ... ```), links and images with optional titles, unordered lists (- or *), ordered lists (1.), blockquotes (> text), horizontal rules (---), and hard line breaks (two trailing spaces). Not supported: tables, task lists, footnotes, definition lists, autolinks, strikethrough, nested lists beyond a single level, and inline HTML pass-through. Code blocks always escape HTML so '<script>' shows as text, and a 'sanitize HTML' toggle (on by default) escapes raw HTML everywhere else too.

Use a maintained parser when you need CommonMark or GFM compatibility, nested structures, extensions, source positions, or untrusted-content handling. Libraries such as marked and markdown-it support broader grammars than this converter, but configuration and sanitization still matter. Check the library's current documentation and bundle impact before choosing one.