usefulweb.site Safe Markdown Preview

Developer & data tools

Safe Markdown Preview

Render Markdown with GFM tables and footnotes to sanitised HTML and see what was removed.

Try an example: Release notes with table, tasks and footnote · XSS attempts are removed and reported · Same input with raw HTML escaped

How it works

Renders Markdown with headings, emphasis, lists, task lists, code, GFM tables, links, images, blockquotes and footnotes into HTML built from a strict allow-list. Raw HTML can be escaped, stripped or sanitised; scripts, event handlers, style attributes and javascript:/vbscript:/data: URLs are removed and listed in a security report. Shows a preview, the sanitised HTML source and a plain-text version.

  • A two-pass parser written for this tool: link-reference and footnote definitions are collected first, then blocks (ATX/setext headings, fenced and indented code, blockquotes, nested bullet/ordered lists with task items, GFM tables with alignment, thematic breaks, HTML blocks, paragraphs) and inline syntax (code spans, emphasis, strikethrough, links, images, autolinks, hard breaks, backslash escapes). It follows CommonMark closely but is not a full conformance implementation; rare edge cases (complex emphasis nesting, lazy continuation inside nested lists) can differ.
  • All output HTML is generated by the renderer from an allow-list (p, h1–h6, lists, tables, code, a, img, blockquote, …). Text and attribute values are always escaped. Raw HTML is escaped, stripped or passed through a tokenizer that rebuilds only allow-listed tags with allow-listed attributes; script/style/iframe/object/svg and similar elements are removed with their content; on* handlers, style, id and class attributes are dropped.
  • URLs (Markdown links, images, href/src attributes) are decoded (entities, escapes) and stripped of control and whitespace characters before the scheme check, so obfuscations like “java	script:” are caught. Allowed: http, https, mailto, tel and relative URLs; data: only for base64 raster images when enabled. Links get rel="nofollow noopener noreferrer".
  • Finally the HTML is balanced (stray closing tags dropped, open tags closed) so raw HTML cannot break out of the preview container. The page’s Content-Security-Policy blocks scripts and external images anyway; the preview is rendered in the browser from the sanitised HTML only.

Sources

For scripts and AI agents

  • JSON API: POST https://safemarkdownpreview.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://safemarkdownpreview.usefulweb.site/mcp · tool name safe_markdown_preview
Example request
curl -s -X POST https://safemarkdownpreview.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"markdown":"# Release notes\n\nVersion **2.4** brings _faster_ parsing, `inline code` and ~~old bugs~~ fixes.[^perf]\n\n- [x] Tables (GFM)\n- [ ] Footnotes\n- Links: [docs](https://example.com/docs \"Documentation\") and <https://usefulweb.site>\n\n| Feature | Status | Notes |\n|:--------|:------:|------:|\n| Tables  | ✓      | GFM   |\n| Images  | ✓      | allow-listed |\n\n> Quote with a [reference link][ref].\n\n```js\nconsole.log(\"code is escaped: <b>\");\n```\n\n[ref]: https://commonmark.org/\n[^perf]: Measured on a 1 MB document.\n"}'

Related tools

  • Crypto Kitchen – CyberChef-style recipes: chain encodings, compression, hashes, AES, JWT and more, step by step.
Feedback