Markdown to HTML

Markdown started as a loosely specified format with no single authoritative grammar, which meant different implementations disagreed on edge cases — how nested lists should behave, whether underscores inside a word count as emphasis — often in ways that produced genuinely different rendered output from the identical source text. CommonMark emerged specifically to fix this by defining a single precise, unambiguous specification that any conforming parser must follow exactly. GitHub Flavored Markdown (GFM) builds on top of that CommonMark foundation and adds several extensions that plain CommonMark does not define at all: tables built from pipe characters and a dashed separator row, task list checkboxes written as `- [ ]` and `- [x]`, strikethrough text wrapped in double tildes, and automatic hyperlinking of bare URLs without needing explicit link syntax. GFM is the dialect this tool implements because it is what GitHub, Reddit, and the overwhelming majority of static site generators and documentation tools have standardised on, making it the most broadly useful target for anything written to be read elsewhere.

Markdown syntax deliberately allows raw HTML to be embedded directly inside it — this is intentional and is what lets Markdown authors drop in an embed, a specific alignment, or a piece of styling that Markdown's own syntax has no shorthand for. The risk is that a `<script>` tag or an inline event handler like `onerror=` pasted into untrusted Markdown would normally execute in whatever context renders it, which is a real cross-site-scripting vector if the Markdown came from someone other than the person viewing the preview. Rendering the live preview inside a sandboxed iframe with scripting disabled means any such script tag or event handler in the preview simply does not run — the browser refuses to execute code inside a properly sandboxed frame, containing the risk to that isolated preview.

What the sandbox does not do is sanitise the *generated HTML output* this tool produces for you to copy — that text-level output still contains whatever raw HTML was present in the original Markdown, faithfully preserved, exactly as Markdown's specification intends. If that generated HTML is going to be inserted into a live page displaying content from an untrusted author, it needs its own separate server-side sanitisation pass before publishing, which is a distinct step from anything this preview sandbox handles.

Markdown was deliberately designed as a shorthand for the HTML constructs writers reach for most often — headings, links, emphasis, lists — rather than as a complete replacement for HTML's full capability. Anything Markdown's own syntax has no equivalent for, from a specific inline style to an embedded video, is meant to be written as literal HTML directly inside the Markdown source, and the parser passes it through unchanged rather than rejecting it as invalid. This is a deliberate design decision going back to Markdown's original specification, not a gap or an oversight in any particular implementation.