discover · compare · collections · requirements · contribute · feed · watching · stats · help with your tokens
showdownjs/showdown · source
Snapshot 0 · 2026-11-04T12:47:21Z · JavaScript · MIT
Content fingerprint
2aa7ec726ef6228b2229179191935266088b151ed65ccb85ab5b4b9b0267139cGitHub description at capture
A bidirectional Markdown to HTML to Markdown converter written in Javascript
README at capture
![Showdown][sd-logo]
[](https://automate.browserstack.com/public-build/VTIvTDNqWVdaTHljbS9RNmYrcTBiL0Uxc3dkRDhaN1dPaXpPb2VOc1B2VT0tLU1Ib09kVjVzMjhFcHExbWFSWlJEV3c9PQ==--1fb92e1730e4a00630d17d533822de6403ca65ec)
[](http://badge.fury.io/js/showdown)
[](http://badge.fury.io/bo/showdown)
[](https://gitter.im/showdownjs/showdown?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
[](https://www.paypal.me/tiviesantos)
------
Showdown is a JavaScript Bidirectional Markdown HTML converter, based on the original works by John Gruber.
Showdown can be used client side (in the browser) or server side (with Node.js).
Showdown can convert Markdown to HTML and HTML to Markdown.
## Live DEMO
<http://demo.showdownjs.eu/>
As you know, ShowdownJS is a free library and it will remain free forever. However, maintaining and improving the library costs time and money.
If you like our work and find our library useful, please donate through [PayPal](https://www.paypal.me/tiviesantos)! Your contribution will be greatly appreciated and help me continue to develop this awesome library.
## License
ShowdownJS (from v2.0 onwards) is released under the MIT license.
Previous versions are released under BSD.
## Who uses Showdown (or a fork)
- [Antmarky](https://github.com/bandantonio/antmarky)
- [GoogleCloudPlatform](https://github.com/GoogleCloudPlatform)
- [Meteor](https://www.meteor.com/)
- [Stackexchange](http://stackexchange.com/) - forked as [PageDown](https://code.google.com/p/pagedown/)
- [docular](https://github.com/Vertafore/docular)
- [md-page](https://github.com/oscarmorrison/md-page)
- [QCObjects](https://qcobjects.dev)
- [and some others...](https://www.npmjs.com/browse/depended/showdown)
## Installation
### Download tarball
You can download the latest release tarball directly from [releases][releases].
### Bower
bower install showdown
### npm (server-side)
npm install showdown
### NuGet package
PM> Install-Package showdownjs
The NuGet Packages can be found [here](https://www.nuget.org/packages/showdownjs/).
### CDN
You can also use one of several CDNs available:
* jsDelivr
https://cdn.jsdelivr.net/npm/showdown@<version tag>/dist/showdown.min.js
* cdnjs
https://cdnjs.cloudflare.com/ajax/libs/showdown/<version tag>/showdown.min.js
* unpkg
https://unpkg.com/showdown/dist/showdown.min.js
*Note*: replace `<version tag>` with an actual full length version you're interested in e.g. `1.9.0`
## Browser Compatibility
Showdown has been tested successfully with:
* Firefox 1.5 and 2.0
* Chrome 12.0
* Internet Explorer 6 and 7
* Safari 2.0.4
* Opera 8.54 and 9.10
* Netscape 8.1.2
* Konqueror 3.5.4
In theory, Showdown will work in any browser that supports ECMA 262 3rd Edition (JavaScript 1.5).
The converter itself might even work in things that aren't web browsers, like Acrobat. No promises.
## Node compatibility
Showdown is intended to work on any supported Node.js version (see the [Node.js releases schedule](https://nodejs.org/en/about/releases/). The code may work with previous versions of Node.js, but no accomidations are made to ensure it does.
## Legacy version
If you're looking for showdown v<1.0.0, you can find it in the [**legacy branch**][legacy-branch].
## Changelog
You can check the full [changelog][changelog]
## Extended documentation
Check our [wiki pages][wiki] for examples and a more in-depth documentation.
## Quick Example
### Node
```js
var showdown = require('showdown'),
converter = new showdown.Converter(),
text = '# hello, markdown!',
html = converter.makeHtml(text);
```
### Browser
```js
var converter = new showdown.Converter(),
text = '# hello, markdown!',
html = converter.makeHtml(text);
```
### Output
Both examples should output...
```html
<h1 id="hello-markdown">hello, markdown!</h1>
```
## Options
You can change some of showdown's default behavior through options.
### Setting options
Options can be set:
#### Globally
Setting a "global" option affects all instances of showdown
```js
showdown.setOption('optionKey', 'value');
```
#### Locally
Setting a "local" option only affects the specified Converter object.
Local options can be set:
* **through the constructor**
```js
var converter = new showdown.Converter({optionKey: 'value'});
```
* **through the setOption() method**
```js
var converter = new showdown.Converter();
converter.setOption('optionKey', 'value');
```
### Getting an option
Showdown provides 2 methods (both local and global) to retrieve previous set options.
#### getOption()
```js
// Global
var myOption = showdown.getOption('optionKey');
//Local
var myOption = converter.getOption('optionKey');
```
#### getOptions()
```js
// Global
var showdownGlobalOptions = showdown.getOptions();
//Local
var thisConverterSpecificOptions = converter.getOptions();
```
### Retrieve the default options
You can get showdown's default options with:
```js
var defaultOptions = showdown.getDefaultOptions();
```
### Valid Options
* **omitExtraWLInCodeBlocks**: (boolean) [default false] Omit the trailing newline in a code block. Ex:
This:
```html
<code><pre>var foo = 'bar';
</pre></code>
```
Becomes this:
```html
<code><pre>var foo = 'bar';</pre></code>
```
* **headerIds**: (false | object) [default `{}`] Controls the `id` attribute generated on headings. Accepts either
`false` (no ids at all) or an object `{prefix, raw}`:
* `{}` (the default) — github-compatible ids (spaces become dashes and most non-alphanumeric chars are stripped), no prefix.
* `prefix` (string) — prepended to every generated id, e.g. `{prefix: 'section-'}`.
* `raw: true` — minimal sanitization: replace only spaces, `'`, `"`, `>` and `<` with dashes (-), including in any prefix,
instead of the default github-compatible style. WARNING: This might result in malformed ids.
* The `prefix` and `raw` settings can be combined, e.g. `{prefix: '/p/', raw: true}`.
> **NOTE**: this option replaces the removed `noHeaderId`, `prefixHeaderId` and `rawHeaderId` options.
> `noHeaderId: true` → `headerIds: false`; `prefixHeaderId: 'foo'` → `headerIds: {prefix: 'foo'}`; `rawHeaderId: true` → `headerIds: {raw: true}`.
* **headerLevelStart**: (integer) [default 1] Set the header starting level. For instance, setting this to 3 means that
```md
# foo
```
will be parsed as
```html
<h3>foo</h3>
```
* **parseImgDimensions**: (boolean) [default false] Enable support for setting image dimensions from within markdown syntax.
Examples:
```
 simple, assumes units are in px
 sets the height to "auto"
 Image with width of 80% and height of 5em
```
* **simplifiedAutoLink**: (boolean) [default false] Turning this option on will enable automatic linking to urls.
This means that:
```md
some text www.google.com
```
will be parsed as
```html
<p>some text <a href="www.google.com">www.google.com</a>
```
* **httpsAutoLinks**: (boolean) [default false] Use `https://` instead of `http://` for the protocol added to
autolinked `www.` urls. Only applies if **simplifiedAutoLink** option is set to `true`. **(since v3.0.0)**
* **literalMidWordUnderscores**: (boolean) [default false] Turning this on will stop showdown from interpreting
underscores in the middle of words as `<em>` and `<strong>` and instead treat them as literal underscores.
Example:
```md
some text with__underscores__in middle
```
will be parsed as
```html
<p>some text with__underscores__in middle</p>
```
* **strikethrough**: (boolean) [default true] Enable support for strikethrough syntax.
`~~strikethrough~~` as `<del>strikethrough</del>`
* **tables**: (boolean) [default false] Enable support for tables syntax. Example:
```md
| h1 | h2 | h3 |
|:------|:-------:|--------:|
| 100 | [a][1] | ![b][2] |
| *foo* | **bar** | ~~baz~~ |
```
See the wiki for more info
* **tablesHeaderId**: (boolean) [default false] If enabled adds an id property to table headers tags.
* **ghCodeBlocks**: (boolean) [default true] Enable support for GFM code block style.
* **tasklists**: (boolean) [default false] Enable support for GFM tasklists. Example:
```md
- [x] This task is done
- [ ] This is still pending
```
* **smartIndentationFix**: (boolean) [default false] Tries to smartly fix indentation problems related to es6 template
strings in the midst of indented code.
* **disableForced4SpacesIndentedSublists**: (boolean) [default false] Disables the requirement of indenting sublists
by 4 spaces for them to be nested, effectively reverting to the old behavior where 2 or 3 spaces were enough.
**(since v1.5.0)**
* **simpleLineBreaks**: (boolean) [default false] Parses line breaks as `<br>`, without
needing 2 spaces at the end of the line **(since v1.5.1)**
```md
a line
wrapped in two
```
turns into:
```html
<p>a line<br>
wrapped in two</p>
```
* **ghMentions**: (boolean) [default false] Enables github @mentions, which link to the username mentioned **(since v1.6.0)**
* **ghMentionsLink**: (string) [default `https://github.com/{u}`] Changes the link generated by @mentions.
Showdown will replace `{u}` with the username. Only applies if ghMentions option is enabled.
Example: `@tivie` with ghMentionsOption set to `//mysite.com/{u}/profile` will result in `<a href="//mysite.com/tivie/profile">@tivie</a>`
* **encodeEmails**: (boolean) [default true] Enable e-mail addresses encoding through the use of Character Entities, transforming ASCII e-mail addresses into its equivalent decimal entities. (since v1.6.1)
NOTE: Prior to version 1.6.1, emails would always be obfuscated through dec and hex encoding.
* **backslashEscapesHTMLTags**: (boolean) [default false] Support for HTML Tag escaping. ex: `\<div>foo\</div>` **(since v1.7.2)**
* **emoji**: (boolean) [default false] Enable emoji support. Ex: `this is a :smile: emoji`
For more info on available emojis, see https://github.com/showdownjs/showdown/wiki/Emojis **(since v.1.8.0)**
* **underline**: (boolean) [default false] ***EXPERIMENTAL FEATURE*** Enable support for underline.
Syntax is **double** or **triple** **underscores** ex: `__underlined word__`. With this option enabled, underscores are no longer parses into `<em>` and `<strong>`.
* **ellipsis**: (boolean) [default true] Replaces three dots with the ellipsis unicode character.
* **completeHTMLDocument**: (boolean) [default false] Outputs a complete html document,
including `<html>`, `<head>` and `<body>` tags' instead of an HTML fragment. (since v.1.8.5)
* **metadata**: (boolean) [default false] Enable support for document metadata (defined at the top of the document
between `«««` and `»»»` or between `---` and `---`). (since v.1.8.5)
```js
var conv = new showdown.Converter({metadata: true});
var html = conv.makeHtml(someMd);
var metadata = conv.getMetadata(); // returns an object with the document metadata
```
* **splitAdjacentBlockquotes**: (boolean) [default false] Split adjacent blockquote blocks.(since v.1.8.6)
* **moreStyling**: (boolean) [default false] Adds some useful classes for css styling. (since v3.0.0)
- Tasklists: Adds the class `task-list-item-complete` to completed tasks items in GFM tasklists.
* **relativePathBaseUrl**: (string) [default ''] Prepends a base URL to relative paths (in links and images).
Absolute paths (starting with a protocol, `//`, or `#`) are left untouched. (since v3.0.0)
#### Security options
By default Showdown follows the trusted-input model and does **not** sanitize (see [XSS vulnerability](#xss-vulnerability)). The options below add opt-in, defense-in-depth hardening for when the Markdown source is untrusted. They are **not** a replacement for a dedicated HTML sanitizer.
* **safeMode**: (boolean) [default false] Defense-in-depth hardening for untrusted Markdown. When enabled it:
- **blocks dangerous URL schemes** (`javascript:`, `vbscript:`, `data:` — except `data:image/...` for image `src`) in generated links/images, resolving obfuscations (entities, control characters) before checking; and
- **escapes all raw HTML tags** and strips inline event-handler attributes (`onerror`, `onload`, `onclick`, …), so embedded `<script>`, `<img onerror=…>` and `<svg onload=…>` cannot execute.
> ⚠️ `safeMode` is **defense-in-depth, not a full HTML sanitizer**. For fully untrusted input, still run the output through a dedicated sanitizer such as [DOMPurify](https://github.com/cure53/DOMPurify) and serve a [Content-Security-Policy](https://developer.mozilla.org/docs/Web/HTTP/CSP). (since v3.0.0)
* **disallowRawHTML**: (boolean) [default false] Applies the GFM ["disallowed raw HTML" tagfilter](https://github.github.com/gfm/#disallowed-raw-html-extension-), escaping the leading `<` of a small blacklist (`title`, `textarea`, `style`, `xmp`, `iframe`, `noembed`, `noframes`, `script`, `plaintext`). This is a narrow GFM-compatibility filter — it does **not** block event handlers, `javascript:` URLs, `<svg>`, etc. Use **safeMode** for broader hardening.
#### CommonMark options **(since v3.0.0)**
These options make Showdown follow the [CommonMark spec](https://spec.commonmark.org/). They are
`boolean` and default to `false`, and are best enabled via the [`commonmark` flavor](#flavors). See the
[Spec compliance docs](docs/spec-compliance.md) for details.
* **cmSpec**: Enable CommonMark spec compliance — parse both block-level constructs (lists, block quotes, HTML blocks, container nesting, tab expansion) and inline constructs (emphasis, links, images, autolinks, raw HTML) per the CommonMark spec instead of Showdown's legacy matching. Most other options still apply on top (GFM extras like `ghMentions`, `simplifiedAutoLink`, `emoji`, `underline`, `tables`, `tasklists`, `parseImgDimensions`, …); a few that tweak the replaced parsers are ignored (`literalMidWordUnderscores`, `splitAdjacentBlockquotes`, …). See the [spec-compliance docs](docs/spec-compliance.md) for the full list.
* **decodeEntities**: Resolve HTML5 named and numeric character references (`©`, `#`, `ಫ`) to their characters. Kept separate from `cmSpec` because it is also useful on its own.
**NOTE**: In the CLI tool, **all** options are ***disabled*** by default — including those (like `ghCodeBlocks`) that are enabled by default in the Node and browser builds.
## Flavors
You can also use flavors or presets to set the correct options automatically, so that showdown behaves like popular markdown flavors.
Currently, the following flavors are available:
* original - original markdown flavor as in [John Gruber's spec](https://daringfireball.net/projects/markdown/)
* vanilla - showdown base flavor (as from v1.3.1)
* gfm - GFM (GitHub Flavored Markdown); `github` is a backwards-compatible alias
* commonmark - [CommonMark](https://spec.commonmark.org/) CommonMark flavor (as from v3.0.0)
### Global
```javascript
showdown.setFlavor('gfm');
```
### Instance
```javascript
converter.setFlavor('gfm');
```
## CLI Tool
Showdown also comes bundled with a Command Line Interface tool. You can check the [CLI wiki page][cli-wiki] for more info
## Integration with AngularJS
ShowdownJS project also provides seamlessly integration with AngularJS via a "plugin".
Please visit https://github.com/showdownjs/ngShowdown for more information.
## Integration with TypeScript
If you're using TypeScript you maybe want to use the types from [DefinitelyTyped][definitely-typed]
## Integration with SystemJS/JSPM
Integration with SystemJS can be obtained via the third party ["system-md" plugin](https://github.com/guybedford/system-md).
## Integration with VueJS
To use ShowdownJS as a Vue component quickly, you can check [vue-showdown](https://vue-showdown.js.org/).
## XSS vulnerability
Showdown doesn't sanitize the input. This is by design since markdown relies on it to allow certain features to be correctly parsed into HTML.
This, however, means XSS injection is quite possible.
**If your Markdown source is untrusted**, you should:
1. Enable the [**safeMode**](#security-options) option — it blocks dangerous URL schemes (`javascript:`, etc.) and escapes raw HTML tags / event handlers as defense-in-depth; **and**
2. Run the generated HTML through a dedicated sanitizer such as [DOMPurify](https://github.com/cure53/DOMPurify) before inserting it into the DOM, and serve a [Content-Security-Policy](https://developer.mozilla.org/docs/Web/HTTP/CSP). `safeMode` is not a full HTML sanitizer and does not replace this step; and
3. Cap the size of untrusted input (and/or convert off the request thread with a timeout) — converting very large adversarial inputs can be CPU-intensive.
Please refer to the wiki article [Markdown's XSS Vulnerability (and how to mitigate it)][xss-wiki]
for more information.
## Extensions
Showdown allows additional functionality to be loaded via extensions. (you can find a list of known showdown extensions [here][ext-wiki])
You can also find a boilerplate, to create your own extensions in [this repository][boilerplate-repo]
### Client-side Extension Usage
```js
<script src="showdown.js" />
<script src="twitter-extension.js" />
var converter = new showdown.Converter({ extensions: ['twitter'] });
```
### Server-side Extension Usage
```js
var showdown = require('showdown'),
myExtension = require('myExtension'),
converter = new showdown.Converter({ extensions: ['myExtension'] });
```
## Building
Building your clone of the repository is easy.
> Prerequesites: a [currently supported](https://nodejs.org/en/about/previous-releases) [Node.js](https://nodejs.org/), [npm](https://www.npmjs.com/package/npm) and [npx](https://www.npmjs.com/package/npx) must be installed.
1. run `npm install`.
2. run `npx grunt build` (see [`Gruntfile.js`](/Gruntfile.js)). This command:
1. Cleans the repo.
2. Checks code quality ([JSHint](https://jshint.com/) and [ESLint](https://eslint.org/)).
3. Runs tests.
4. Creates the [distributable](/dist/showdown.js) and [minified](/dist/showdown.min.js) files in the [`dist`](/dist) folder.
## Tests
A suite of tests is available which require Node.js. Once Node is installed, run the following command from
the project root to install the dependencies:
npm install
Once installed the tests can be run from the project root using:
npm test
New test cases can easily be added. Create a markdown file (ending in `.md`) which contains the markdown to test.
Create a `.html` file of the exact same name. It will automatically be tested when the tests are executed with `mocha`.
## Contributing
If you wish to contribute please read the following quick guide.
### Want a Feature?
You can request a new feature by submitting an issue. If you would like to implement a new feature feel free to issue a
Pull Request.
### Pull requests (PRs)
PRs are awesome. However, before you submit your pull request consider the following guidelines:
- Search GitHub for an open or closed Pull Request that relates to your submission. You don't want to duplicate effort.
- When issuing PRs that change code, make your changes in a new git branch based on **develop**:
```bash
git checkout -b my-fix-branch develop
```
- Run the full test suite before submitting and make sure all tests pass (obviously =P).
- Try to follow our [**coding style rules**][coding-rules]. Breaking them prevents the PR to pass the tests.
- Refrain from fixing multiple issues in the same pull request. It's preferable to open multiple small PRs instead of one
hard to review big one.
- If the PR introduces a new feature or fixes an issue, **please add the appropriate test case**.
- We use [conventional commit][conventional-commits] notes to generate the changelog that follow the conventional changelog spec. It's extremely helpful if your commit messages adhere to these [Commit Guidelines][conventional-commits].
- Don't forget to add your name to the [CREDITS.md](https://github.com/showdownjs/showdown/blob/master/CREDITS.md) file. We like to give credit were it's due.
- If we suggest changes then:
- Make the required updates.
- Re-run the test suite to ensure tests are still passing.
- Rebase your branch and force push to your GitHub repository (this will update your Pull Request):
```bash
git rebase develop -i
git push origin my-fix-branch -f
```
- After your pull request is merged, you can safely delete your branch.
If you have time to contribute to this project, we feel obliged that you get credit for it.
These rules enable us to review your PR faster and will give you appropriate credit in your GitHub profile.
We thank you in advance for your contribution!
### Joining the team
We're looking for members to help maintaining Showdown.
Please see [this issue](https://github.com/showdownjs/showdown/issues/114) to express interest or comment on this note.
## Credits
Full credit list at https://github.com/showdownjs/showdown/blob/master/CREDITS.md
Showdown is powered by:<br/>
[](https://www.jetbrains.com/webstorm/)
[sd-logo]: https://raw.githubusercontent.com/showdownjs/logo/master/dist/logo.readme.png
[legacy-branch]: https://github.com/showdownjs/showdown/tree/legacy
[releases]: https://github.com/showdownjs/showdown/releases
[changelog]: https://github.com/showdownjs/showdown/blob/master/CHANGELOG.md
[wiki]: https://github.com/showdownjs/showdown/wiki
[cli-wiki]: https://github.com/showdownjs/showdown/wiki/CLI-tool
[definitely-typed]: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/showdown
[xss-wiki]: https://github.com/showdownjs/showdown/wiki/Markdown's-XSS-Vulnerability-(and-how-to-mitigate-it)
[ext-wiki]: https://github.com/showdownjs/showdown/wiki/extensions
[coding-rules]: https://github.com/showdownjs/code-style/blob/master/README.md
[conventional-commits]: https://www.conventionalcommits.org/
[boilerplate-repo]: https://github.com/showdownjs/extension-boilerplate