Professional Markdown editor with live GitHub-style preview, Mermaid diagrams, and high-performance export options.
Markdown is a lightweight markup language created by John Gruber in 2004. Its core philosophy is that formatted text should be readable as plain text, without looking like it's been marked up with tags.
A parser reads the text line by line. When it sees syntax like # Hello, it replaces it with the corresponding HTML <h1>Hello</h1>.
By design, the Markdown specification allows authors to use raw HTML directly within the document. If you type <button>Click</button>, the parser leaves it alone and it renders as a functional button.
This is incredibly dangerous in modern web applications (like comments sections). If an attacker writes a Markdown post containing <script>stealCookies()</script>, the naive parser will blindly output that script into the browser's DOM, executing malicious code instantly.
To prevent Cross-Site Scripting (XSS), KaruviLab forces all rendered HTML through a library called DOMPurify before it ever touches your screen.
The purifier analyzes the parsed HTML tree, strips out all dangerous elements (<script>, <iframe>) and malicious event attributes (onclick=), while preserving safe display tags (headings, bold, images). This guarantees you can safely preview any unknown Markdown file without risking device compromise.
Why is rendering raw Markdown generated by users considered a security risk?
