Markdown Editor
Write Markdown with a sanitized live HTML preview and local-only autosave; nothing is uploaded and no code runs.
- Runs locally in your browser
- No upload required
Capabilities
- Drag and drop
- Local file intake
- Download result
Try it
Supported formats
Privacy
Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.
Sanitized Markdown preview for a 54 characters across 6 line(s).
How it works
- The Markdown source is rendered to a small, explicit HTML subset, then passed through the allowlist sanitizer.
- Active content (scripts, event handlers, dangerous URLs, SVG/MathML and external resources) is removed; the result is rendered only inside an empty-token sandboxed preview.
- Counts: 54 characters, 11 words, 6 lines.
Methodology
- Normalize line endings and parse the documented Markdown block subset (headings, paragraphs, lists, blockquotes, fenced code and thematic breaks).
- Render inline emphasis, code spans and links to a small, explicit HTML subset; raw HTML in the source is escaped, never passed through.
- Pass the generated HTML through the shared allowlist sanitizer before it is shown in the sandboxed preview.
Usage
- Type or paste Markdown into the editor; the sanitized preview updates as you type.
- Use Format to normalize heading/list markers with the shared Markdown formatter.
- Turn on “Keep in this browser” to autosave locally; use Clear/Reset to remove the stored document.
Examples
These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.
Heading, emphasis and a list
{
"text": "# Title\n\nSome **bold** and *italic* text.\n\n- one\n- two"
}Renders a heading, a paragraph and an unordered list.
A fenced code block
{
"text": "Intro\n\n```js\nconst x = 1; <tag>\n```\n"
}Code-block content is preserved verbatim and escaped.
Limitations
How the preview stays safe
The Markdown source is turned into a small, explicit HTML subset; any raw HTML in the source is shown as text.
The generated HTML is then sanitized with an allowlist and rendered only inside a sandboxed preview frame, so no script, event handler or external resource can run.
Local-only autosave
Autosave is off by default. When you enable it, the document is stored only in this browser under one key and Clear/Reset removes it. No account, server or upload is involved.
Frequently asked questions
- Is my Markdown uploaded?
- No. The document is parsed and rendered in your browser only; nothing is sent to a server.
- Can a script in my Markdown run?
- No. Raw HTML is escaped and the rendered preview is sanitized and shown in a sandboxed frame, so no script can execute.
Sources
- CommonMark Specification 0.31.2 — CommonMark
- OWASP Cross Site Scripting Prevention Cheat Sheet — OWASP
Send feedback
Tell us if this tool helped, report a problem, or suggest a tool. Only the message you type is sent — never the input you used in the tool.
Was this tool useful?
Prefer to write to us directly? See the contact page.