Markdown to HTML Converter

In 2004, John Gruber grew frustrated with the available options for writing web content. HTML was too verbose for everyday writing. WYSIWYG editors produced messy markup and trapped content in proprietary formats. Existing lightweight markup languages were either too limited or too complex. Gruber wanted something that looked good as plain text, was easy to read and write, and could be converted to structurally valid HTML. Markdown was born from this desire for simplicity.

Gruber wrote the original Markdown syntax description in Perl, releasing it on his website Daring Fireball. The specification was intentionally informal—a philosophy that prioritized human readability over machine rigor. This approach fueled adoption but also created a problem: different implementers made different choices about ambiguous cases. Should a list item with multiple paragraphs be indented by four spaces or aligned with the first text column? The original spec did not say, leading to incompatible parsers.

CommonMark, launched a decade later, resolved these ambiguities with a formal specification and an extensive test suite containing over 600 examples. It became the foundation upon which GitHub Flavored Markdown, Markdown Extra, and countless other dialects were built. Today, Markdown is the lingua franca of developer documentation, supported by GitHub, GitLab, Bitbucket, Stack Overflow, Reddit, Notion, Obsidian, and virtually every static site generator.

Parsing Approaches: Regex vs AST

The simplest way to convert Markdown to HTML is with regular expressions: find patterns like **text** and replace them with text. This approach works for basic documents but fails spectacularly with nested structures. Consider a bold link inside a list item inside a blockquote—regex cannot reliably track nesting depth or handle overlapping patterns.

Professional parsers use a two-phase approach. First, they tokenize the input into an Abstract Syntax Tree (AST), identifying block-level elements (paragraphs, headings, lists) and inline elements (links, emphasis, code) as separate node types. Second, they walk the tree recursively, emitting HTML for each node. This architecture correctly handles arbitrary nesting, validates structure, and enables powerful plugins that transform the AST before rendering. Tools like remark (JavaScript), pulldown-cmark (Rust), and goldmark (Go) all follow this design.

Security: The XSS Risk in Markdown

A critical but often overlooked aspect of Markdown processing is security. Markdown intentionally allows raw HTML inline—this is a feature, not a bug, enabling authors to insert advanced markup when needed. However, when Markdown comes from untrusted users, raw HTML becomes an attack vector. A malicious user can write:

<img src=x onerror=alert('xss')>

If the converter passes this through verbatim, any visitor viewing the page executes the attacker's JavaScript. Secure Markdown pipelines must either disable raw HTML entirely or sanitize the output using a library like DOMPurify, which strips dangerous tags and attributes while preserving legitimate formatting.

External References

• Wikipedia — Markdown
• CommonMark Specification
• GitHub Flavored Markdown Spec
• Daring Fireball — Original Markdown

Related NerdsTips Tools

• HTML Formatter — Format, beautify, and minify HTML code with syntax validation.
• HTML Entity Encoder / Decoder — Escape special characters for safe HTML embedding.
• Text to Slug Converter — Convert any text to clean, URL-friendly slugs.