How it works
How Markdown and HTML are converted in your browser
Private Markdown Converter is a privacy-first Markdown and HTML tool. Every step, from parsing through export, runs locally in your browser. There is no backend that receives your document content and no database that stores it.
1. You write or import content
Type Markdown, paste Markdown or HTML, or load a local .md, .markdown, .htm, or .html file. The file is read in-memory by JavaScript in your browser tab. No content is sent to a server.
2. Markdown is rendered to HTML
The Markdown parser runs in the browser and supports CommonMark plus GitHub Flavored Markdown: headings, lists, task lists, links, images, blockquotes, code blocks, tables, and strikethrough. Links and images are passed through a safe-URL filter during rendering.
3. The HTML is sanitized
The rendered HTML (and pasted HTML for the HTML to PDF mode) is passed through DOMPurify with a strict allowlist. Scripts, iframes, embedded objects, forms, event handlers, and unsafe URL schemes are removed. External links get rel="noopener noreferrer" and target="_blank". The sanitized HTML is what you see in the preview and what is exported.
4. You export
For HTML export, the sanitized body is wrapped in a standalone document with embedded CSS, no external dependencies, and no scripts. For PDF export, the sanitized body is wrapped in a print-styled document and opened in a hidden frame. The browser's print dialog performs the final save. No content leaves your device.
What never happens
- Your Markdown and HTML content are never transmitted to a backend.
- No content is written to local storage by default.
- No third-party tracking, advertising, or session recording runs on the page.
- No remote images, fonts, or stylesheets are loaded by default.
- No scripts in pasted HTML are ever executed.
WebF1 builds custom business systems, integrations, and practical software tools. Read the full privacy page or try a converter: