Markdown Editor

Write Markdown with a sanitized live HTML preview and local-only autosave; nothing is uploaded and no code runs.

  • Runs locally in your browser
  • No upload required

Capabilities

  • Drag and drop
  • Local file intake
  • Download result

Try it

or drop a text file here.

Off by default. When on, this document is stored only on this device and Clear / Reset removes it. No account, server or upload is involved.

Characters
74
Words
12
Lines
4

Preview is sanitized and shown in a sandboxed frame. User code never runs; external resources are never loaded.

Supported formats

Input
text/markdown
Output
text/markdown, text/html
Files
Local file intake and drag/drop

Privacy

Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.

Processing
In your browser
Privacy level
Browser only

Sanitized Markdown preview for a 54 characters across 6 line(s).

How it works

  • The Markdown source is rendered to a small, explicit HTML subset, then passed through the allowlist sanitizer.
  • Active content (scripts, event handlers, dangerous URLs, SVG/MathML and external resources) is removed; the result is rendered only inside an empty-token sandboxed preview.
  • Counts: 54 characters, 11 words, 6 lines.

Methodology

  1. Normalize line endings and parse the documented Markdown block subset (headings, paragraphs, lists, blockquotes, fenced code and thematic breaks).
  2. Render inline emphasis, code spans and links to a small, explicit HTML subset; raw HTML in the source is escaped, never passed through.
  3. Pass the generated HTML through the shared allowlist sanitizer before it is shown in the sandboxed preview.

Usage

  1. Type or paste Markdown into the editor; the sanitized preview updates as you type.
  2. Use Format to normalize heading/list markers with the shared Markdown formatter.
  3. Turn on “Keep in this browser” to autosave locally; use Clear/Reset to remove the stored document.

Examples

These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.

Heading, emphasis and a list

jsonSelect to copy
{
  "text": "# Title\n\nSome **bold** and *italic* text.\n\n- one\n- two"
}

Renders a heading, a paragraph and an unordered list.

A fenced code block

jsonSelect to copy
{
  "text": "Intro\n\n```js\nconst x = 1; <tag>\n```\n"
}

Code-block content is preserved verbatim and escaped.

Limitations

How the preview stays safe

The Markdown source is turned into a small, explicit HTML subset; any raw HTML in the source is shown as text.

The generated HTML is then sanitized with an allowlist and rendered only inside a sandboxed preview frame, so no script, event handler or external resource can run.

Local-only autosave

Autosave is off by default. When you enable it, the document is stored only in this browser under one key and Clear/Reset removes it. No account, server or upload is involved.

Frequently asked questions

Is my Markdown uploaded?
No. The document is parsed and rendered in your browser only; nothing is sent to a server.
Can a script in my Markdown run?
No. Raw HTML is escaped and the rendered preview is sanitized and shown in a sandboxed frame, so no script can execute.

Sources

  1. CommonMark Specification 0.31.2 — CommonMark
  2. OWASP Cross Site Scripting Prevention Cheat Sheet — OWASP