Is the generated HTML safe to insert into a page?

It is sanitized against an element and attribute allowlist, which removes scripts, event handlers and javascript: URLs. Even so, apply a Content Security Policy — defence in depth matters more than any single sanitizer.

Why does my table not render?

Tables are a GitHub Flavored Markdown extension, not part of CommonMark. Renderers that implement them also require a header row and a delimiter row with at least three dashes per column.

Can I keep my raw HTML in the output?

No. Passing raw HTML through is exactly the behaviour that makes Markdown rendering a stored-XSS vector, so it is removed. Post-process the output yourself if you control the input.

Does it support GitHub-style task lists?

Checkbox syntax renders as literal text under strict CommonMark. If you need task lists, render with a GFM-enabled parser in your own pipeline.

Developer🌐 YAS server-sideAPI availableintermediate

Markdown → HTML

Renders Markdown into sanitized HTML.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Renders Markdown into sanitized HTML.

Why would I use it?

You are previewing a README or doc as HTML.
You want safe HTML output for a static site.
You are testing how Markdown renders.

Real-life example

Input

# Hi

- one
- two

Output

<h1>Hi</h1>
<ul><li>one</li><li>two</li></ul>

The output is sanitized to remove script and dangerous markup.

Input → Process → Output → Next

Input: Paste Markdown.
Process: YAS renders it to HTML and sanitizes the result.
Output: Sanitized HTML.
Next action: Use the HTML in your site or email.

Common mistakes

Expecting raw HTML blocks to pass through unsanitized.
Using unsupported extensions (tables may render simply).
Assuming the output is safe if unsanitized.

What the result means

Sanitized means scripts and event handlers are stripped.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/markdown-to-html

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/markdown-to-html" \
  -H "Content-Type: application/json" \
  -d '{"input":"# Hello\n\n**bold**"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/markdown-to-html", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "# Hello\n\n**bold**"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/markdown-to-html", json={"input":"# Hello\n\n**bold**"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Markdown (≤ 64 KB)

Success response

{ "result": "<h1>Hello</h1>\n<p><strong>bold</strong></p>" }

Render Markdown to sanitized HTML (marked + sanitize-html allow-list, XSS-safe).

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Markdown → HTML works

The Markdown source is parsed into an abstract syntax tree following CommonMark block and inline rules — block structure (headings, lists, fences, block quotes) is resolved first, then inline structure (emphasis, links, code spans) inside each block. The tree is then rendered to HTML, which is why malformed nesting produces predictable output instead of a parse failure: Markdown has no invalid documents, only documents that mean something other than you intended.

Output is sanitized after rendering. CommonMark permits raw HTML passthrough, so an untrusted document can contain script tags, event-handler attributes and javascript: URLs. The renderer strips those against an allowlist of elements and attributes, which is the difference between a Markdown renderer and a stored-XSS vulnerability in any application that displays user-submitted content.

When to use it: real-world scenarios

Previewing README rendering before pushing

Table alignment, nested list indentation and fenced-code language hints are the three things that look right in an editor and wrong on the host. Rendering locally catches them before the commit.

Converting docs for a CMS that only accepts HTML

Authors write Markdown, the CMS stores HTML. Converting at the boundary keeps the source-of-truth in version control while satisfying the platform.

Rendering user-submitted comments safely

Markdown gives users formatting without giving them HTML. The sanitization step is what makes that safe; verify here that the tags you expect to be stripped actually are.

Generating email bodies from Markdown

HTML email needs inline styles and a restricted tag set. Convert first, then inline the CSS — the converted output shows exactly which elements you need rules for.

Pro tips

Indent nested list items by the width of the parent marker (usually two or three spaces). Four spaces after a list item creates a code block in some parsers and a nested list in others.
Always tag fenced code blocks with a language. It drives syntax highlighting and, in many pipelines, doc tests and link checking.
A single newline is not a paragraph break in CommonMark. Use a blank line, or two trailing spaces for a hard line break.
Reference-style links keep long URLs out of the prose and make broken links easier to audit in bulk.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

CommonMark only. GitHub Flavored Markdown extras — task lists, autolinked literals, strikethrough, tables — vary by renderer; verify anything you depend on.
Raw HTML is sanitized, so a document that deliberately embeds an iframe or a style block will lose it.
No front matter parsing. YAML front matter is treated as text or a thematic break, not metadata.
Footnotes, definition lists and math (KaTeX/MathJax) are extensions, not core CommonMark, and are not rendered.

Frequently asked questions

Is the generated HTML safe to insert into a page?: It is sanitized against an element and attribute allowlist, which removes scripts, event handlers and javascript: URLs. Even so, apply a Content Security Policy — defence in depth matters more than any single sanitizer.
Why does my table not render?: Tables are a GitHub Flavored Markdown extension, not part of CommonMark. Renderers that implement them also require a header row and a delimiter row with at least three dashes per column.
Can I keep my raw HTML in the output?: No. Passing raw HTML through is exactly the behaviour that makes Markdown rendering a stored-XSS vector, so it is removed. Post-process the output yourself if you control the input.
Does it support GitHub-style task lists?: Checkbox syntax renders as literal text under strict CommonMark. If you need task lists, render with a GFM-enabled parser in your own pipeline.

Related tools

HTML → Markdown HTML Escape