See your Markdown rendered side by side and copy the HTML — the preview runs sandboxed in your browser.
Markdown is plain text with a few punctuation conventions — a hash for a heading, asterisks for emphasis, a hyphen for a list item — that a converter turns into HTML. This tool renders it with marked in GitHub Flavored Markdown mode, so what people actually write survives: tables, fenced code blocks tagged with a language, task lists, strikethrough and bare URLs that become links. The preview sits beside the editor and redraws as you type, so you catch the broken table or the unclosed code fence while writing, not after you push the README.
A Markdown converter has one security decision to make, and this page states it instead of glossing over it: marked does not sanitise anything. Markdown allows raw HTML on purpose, so a script tag, an image with an onerror handler or a link pointing at a javascript: URL come out of the parser exactly as they went in. Rendering that inside this page would be a cross-site scripting hole. Rather than write a sanitiser, the preview is drawn inside an iframe whose sandbox attribute is empty — every restriction switched on. Without allow-scripts nothing executes and no event handler fires; without allow-same-origin the frame sits in an opaque origin and cannot read this page, its cookies or its storage. A Content-Security-Policy of default-src 'none' inside the frame is a second, independent layer. A sanitiser would have shown you something different from the HTML you are about to copy, which in a preview is exactly the wrong trade.
What is deliberately not sanitised is the HTML itself, because that is the product: copy and download hand you exactly what marked produced. So when your Markdown contains something that can run code, the tool names it — script, iframe, form, an on-handler, a javascript: URL — and reminds you that the isolation stops at the preview. Publish that HTML where the Markdown came from somebody else and the risk travels with it. Everything runs in JavaScript on your own device and nothing you type is uploaded. The only request the preview makes is one you wrote yourself, when an image points at an external URL. Links in the preview are not clickable: the price of the sandbox, and for a preview a cheap one.
No. The text is parsed and rendered by JavaScript on your device: nothing is sent to any server, stored or logged. Disconnect from the internet after the page loads and the tool still works.
No, and it does not pretend to. The preview is isolated in a sandboxed iframe, so nothing runs there, but the HTML you copy is exactly what the parser produced. If the Markdown came from someone else, sanitise it before publishing.
Because the preview frame has every sandbox restriction on, and navigation is one of them — the same switch that stops a javascript: link from firing. Copy the HTML if you need the links live.
GitHub Flavored Markdown: CommonMark plus tables, fenced code blocks with a language tag, task lists, strikethrough and automatic links. Headings get no id attributes, so the anchors GitHub builds for a table of contents are missing.
Copy gives the HTML fragment, to paste into a page you already have. The download wraps it in a complete document with a UTF-8 charset and readable styling, so it opens correctly on its own, accents intact.
Because in standard Markdown a single newline is just a space — paragraphs are separated by a blank line. Chat boxes and comment fields break on every Enter, so tick "Treat single line breaks as
" when writing for one.
Vai.la turns any URL into a short link with click statistics, QR Code and your own biolink.
Vai.la is not responsible for how the tools are used or for decisions made based on their results.