Rich text / Markdown
Write Markdown on the left, preview on the right; rich text and HTML convert to Markdown in one click; paste Excel or CSV data to get a Markdown table
Markdown 源码 → 实时预览
导出与复制
导出的内容以 Markdown 源码框为准（富文本「转成 Markdown」与 HTML 转换的结果都会先写回那里）； 文件名形如 markdown-20260607120000.md，由浏览器在本地生成并下载，不经服务器。
Markdown、富文本与 HTML：各自适合什么，以及本页做了什么净化
Markdown 语法要点，一屏就能记住。标题用行首的 #（一级一个、二级两个，最多到六级）；**粗体** 与 *斜体* 用星号包裹；行首 > 是引用；- 或 1. 开头是列表；四个空格或三个反引号包起来是代码；方括号接圆括号是链接（方括号里写文字、圆括号里写网址），感叹号加方括号是图片；一行里用竖线分隔、并在下一行写上 --- 就是表格；三个及以上的连字符或星号独占一行是分隔线。这些符号都是纯 ASCII，任何编辑器、任何系统都能读懂，也不会因为换一个软件就"格式全丢"。本页左侧的工具栏就是往光标处插入这些片段，选中的文字会被自动包进成对标记里。
Markdown 和富文本各自的适用场景。富文本（Word、公众号后台、各类所见即所得编辑器）的优势是所见即所得：加粗就是加粗，字号颜色随点随有，交给完全不懂标记的人也能用，排版精细度高。代价是它把"内容"和"样式"绑在一起存成 HTML，同一段文字在不同软件里可能渲染成两个样子。Markdown 的优势是纯文本：一份 .md 文件用记事本打开也能读，用 Git 能看出一行行改了什么，转换成网页、PDF、公众号排版都只是换一个渲染器。代价是它表达能力有限——字体、颜色、居中、分栏这些它基本不管，需要精细排版时仍要回到富文本或 HTML。一个实用的分工是：存稿、写文档、写技术笔记用 Markdown；最终交付或需要精细排版的成品用富文本。本页把三条路都放在一起，就是为了让你在两者之间随时来回：Markdown 写好了可以直接导出 HTML，从别处复制的富文本或 HTML 也能一键退回 Markdown。
为什么 Markdown 更适合长期存稿。第一，它是纯文本，二十年后任何系统都能打开，不会像老版本的 .doc 那样需要特定软件才能还原；第二，它不依赖样式表，把同一份文件渲染成网页、PDF、电子书只是换渲染器的事；第三，它对版本管理友好，一次修改在 Git 里就是一两行差异，而富文本的一处加粗往往会改掉整段 HTML；第四，它便于程序处理，脚本、静态站点生成器、AI 工具都直接吃 Markdown。需要提醒的是：Markdown 没有统一标准，CommonMark 是最接近共识的规范，表格、删除线、任务列表这些属于 GFM 扩展，不同平台的渲染结果可能略有出入——所以同一份稿件在目标平台上先预览一遍，永远是好习惯。
XSS 是什么，本页做了哪些净化。XSS（跨站脚本）指攻击者把可执行的脚本混进网页内容里，让它在别人的浏览器中运行，从而窃取登录凭据、冒充用户操作。Markdown 本身相对安全，但它允许内嵌原始 HTML，而 Markdown 转出来的是 HTML 字符串——如果直接把这段字符串塞进页面，粘贴进来的 <script>、图片上的 onerror 事件、或者 href="javascript:…" 这类链接就有可能被执行。本页因此在渲染与导出前统一过一遍基础净化：整块移除 script、iframe、object、embed、style 等可执行或可嵌入外部内容的元素；移除全部以 on 开头的事件属性；把 javascript:、vbscript: 以及非图片的 data: 协议链接从 href/src 里摘掉；其余不在白名单内的标签被剥掉、只保留其中的文字。净化逻辑是一个不依赖浏览器的纯函数，因此它本身可以被逐条断言。但必须说清楚：这是基础净化，不是专业级防护——现实中的攻击面还包括 CSS 注入、SVG 内嵌脚本、畸形标签解析差异等等，专业场景请使用成熟的净化库。所以本页的定位是"处理你自己写的内容"，不要用它渲染来源不可信的内容。
为什么不上传到服务器，也不做历史记录。Markdown 渲染与 HTML 转 Markdown 都是纯计算：前者是把标记换成标签，后者是把标签换成标记，两步都不需要后端能力，浏览器里几十毫秒就能做完。而这类内容往往正是最私密的那一类——未发布的稿件、内部文档、会议记录、客户材料、产品需求。上传到别人的服务器意味着多一份副本、多一处泄露面，也意味着服务端要为你保存和清理这些文本。所以本页全程在你的设备上完成：渲染、转换、导出、复制全部由页面内的 JavaScript 执行，脚本来自本站自托管（没有 CDN、没有外部请求），你输入的文字不写进网址参数、不写进 localStorage 或 sessionStorage、不写进 cookie，刷新页面就回到空白状态。打开浏览器开发者工具的 Network 面板，整页不会出现任何提交请求——这一点你可以自己验证。
FAQ
The preview renders Markdown into HTML in your browser with self-hosted marked, applies a basic sanitization pass, and shows the result on the right; HTML-to-Markdown uses the similarly self-hosted turndown. Both libraries load from this site only on first use (roughly 45KB and 27KB, cached by your browser afterwards); the page has no upload endpoint and references no CDN. Your text stays inside this page the whole time - close or refresh and nothing remains.
Because the rich-text area uses the browser's native contenteditable and document.execCommand. execCommand has been deprecated by standards bodies; mainstream browsers still support it, but implementation details differ: the same 'bold' inserts a b tag in one browser and an inline-styled span in another; pasting external content drags in tangles of styles and nesting; lists and blockquotes come out as different tags across browsers. So this page positions it as an assistive tool for quickly turning existing content into Markdown - for long documents trust the Markdown source pane as authoritative, and even after converting, give the Markdown a quick second scan.
Yes, it is lossy, and this is a limit of conversion itself: Markdown can express headings, bold/italic, links, images, lists, quotes, code and rules - nothing more. Font sizes, colors, center alignment, multi-column layout have no equivalent, and turndown drops them outright (a colored, centered paragraph converts to plain text). One thing to call out: turndown's default rules include no table support - a table converts into ordinary paragraphs of one cell per line, losing the row/column structure. For tables, switch to the 'table to Markdown table' tab and paste the data to get a proper table; merged cells spanning rows or columns are simply inexpressible in Markdown. Code blocks depend on the source too: if the original HTML stored code as ordinary paragraphs with CSS whitespace (many WYSIWYG editors do exactly that), they arrive as plain text and need manual triple-backticks.
Use the 'table to Markdown table' tab: copy-paste straight from Excel or a web table (tab-separated), or paste CSV (commas) or pipe-delimited text - the delimiter is auto-detected by default and can be set manually. The 'first row is the header' checkbox decides the header row, each column gets its own left/center/right alignment, and the output carries :--- alignment markers. Pipes inside cells are escaped automatically, and all processing runs locally in your browser, no upload.
It blocks the most common classes: script-element tags, embeddable elements like iframe/object/embed, every event attribute whose name starts with the two letters on (error-handler and click-handler attributes for short), and the scripting, vbscript and data URL protocols inside href/src (only data:image/ pictures are let through) - other tags go through a whitelist, and anything off-list is stripped to its text. That covers the overwhelming majority of 'paste some Markdown/HTML from elsewhere' scenarios. But it is not professional-grade sanitization: the real attack surface also includes CSS injection, scripts embedded in SVG, and browsers' differing parses of malformed tags - so do not use it to render untrusted content, and use a mature sanitizer library for serious scenarios.
The rule: CJK characters (Chinese, Japanese kana, Korean) count one word per character; everything else splits on whitespace, each run being one word; numbers and English abbreviations count as one word. This exists because Chinese has no spaces - splitting on whitespace would score a whole Chinese paragraph as 1 word, absurdly low. The character count tallies Unicode code points (emoji and rare CJK ideographs are surrogate pairs and are not double-counted), and the line count counts newline characters (empty text is 0 lines). All three counters are written as pure functions - the page and the export run the exact same implementation.