Preview (sanitized)
Rendered HTML is sanitized with DOMPurify before insertion — scripts, inline event handlers, and other XSS vectors are stripped, even if you paste raw HTML into the Markdown source.
Write Markdown with a live, sanitized HTML preview side by side.
Rendered HTML is sanitized with DOMPurify before insertion — scripts, inline event handlers, and other XSS vectors are stripped, even if you paste raw HTML into the Markdown source.
Write Markdown in a split-pane editor and see a live-rendered preview next to it. Rendered HTML is passed through a sanitizer before it ever touches the DOM, so pasted or written HTML can't execute scripts. Copy the raw HTML or the rendered plain text with one click.
Markdown itself is harmless text, but rendering it to HTML isn't automatically safe — GitHub-flavored Markdown lets raw HTML pass through untouched, which means a stray <script> or an <img onerror=...> in your source would otherwise execute in the browser rendering the preview. This is the one tool on SparkJSON where that risk is real, so it's the one place we sanitize before rendering.
The pipeline is: markdown text → marked (a fast, spec-compliant Markdown parser) produces raw HTML → DOMPurify strips anything that could execute script or trigger unexpected behavior (script tags, inline event handlers, javascript: URLs, and similar) → the result goes into the preview pane. Both steps run client-side; nothing about your document is ever sent anywhere.
"Copy raw HTML" gives you the sanitized markup itself — useful for pasting into a CMS or email client. "Copy rendered text" strips all markup and gives you the plain reading text, useful when you just want the words without formatting.