# Safe Markdown Preview

> Render Markdown with GFM tables and footnotes to sanitised HTML and see what was removed. Renders Markdown with headings, emphasis, lists, task lists, code, GFM tables, links, images, blockquotes and footnotes into HTML built from a strict allow-list. Raw HTML can be escaped, stripped or sanitised; scripts, event handlers, style attributes and javascript:/vbscript:/data: URLs are removed and listed in a security report. Shows a preview, the sanitised HTML source and a plain-text version.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://safemarkdownpreview.usefulweb.site/ (interactive tool at https://safemarkdownpreview.usefulweb.site/tool)
- JSON API: POST https://safemarkdownpreview.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://safemarkdownpreview.usefulweb.site/api/v1/tool)
- OpenAPI: https://safemarkdownpreview.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://safemarkdownpreview.usefulweb.site/mcp - tool `safe_markdown_preview`

## Inputs
- markdown (textarea): Markdown
- file (file): Or upload a Markdown file
- rawHtml (select): Raw HTML in the Markdown
- gfm (boolean): GitHub extensions (tables, task lists, strikethrough, bare URLs)
- footnotes (boolean): Footnotes ([^1])
- allowDataImages (boolean): Allow base64 data: images (PNG/JPEG/GIF/WebP/AVIF; never SVG)

## Method
- A two-pass parser written for this tool: link-reference and footnote definitions are collected first, then blocks (ATX/setext headings, fenced and indented code, blockquotes, nested bullet/ordered lists with task items, GFM tables with alignment, thematic breaks, HTML blocks, paragraphs) and inline syntax (code spans, emphasis, strikethrough, links, images, autolinks, hard breaks, backslash escapes). It follows CommonMark closely but is not a full conformance implementation; rare edge cases (complex emphasis nesting, lazy continuation inside nested lists) can differ.
- All output HTML is generated by the renderer from an allow-list (p, h1–h6, lists, tables, code, a, img, blockquote, …). Text and attribute values are always escaped. Raw HTML is escaped, stripped or passed through a tokenizer that rebuilds only allow-listed tags with allow-listed attributes; script/style/iframe/object/svg and similar elements are removed with their content; on* handlers, style, id and class attributes are dropped.
- URLs (Markdown links, images, href/src attributes) are decoded (entities, escapes) and stripped of control and whitespace characters before the scheme check, so obfuscations like “java	script:” are caught. Allowed: http, https, mailto, tel and relative URLs; data: only for base64 raster images when enabled. Links get rel="nofollow noopener noreferrer".
- Finally the HTML is balanced (stray closing tags dropped, open tags closed) so raw HTML cannot break out of the preview container. The page’s Content-Security-Policy blocks scripts and external images anyway; the preview is rendered in the browser from the sanitised HTML only.