markdown-it, remarkable, and showdown are JavaScript libraries that convert Markdown syntax into HTML. They enable developers to render user-authored or content-driven Markdown in web applications, supporting features like extensibility, security, and customization. Each library offers a different balance of performance, configurability, and ease of use, making them suitable for distinct project requirements.
When you need to turn Markdown into HTML in a JavaScript app — whether for a blog editor, a documentation site, or user comments — picking the right parser matters. markdown-it, remarkable, and showdown all solve this problem, but they do it in very different ways. Let’s compare how they handle real-world needs like security, extensibility, and performance.
markdown-it uses a modular pipeline based on tokens and rules. It parses Markdown into a token stream, then renders those tokens to HTML using configurable renderer functions. This design makes it easy to inspect, modify, or extend behavior at any stage.
// markdown-it: add a custom rule
const md = require('markdown-it')();
md.core.ruler.push('my_rule', function(state) {
// manipulate state.tokens here
});
remarkable also uses a token-based approach but with a less granular API. It exposes a few hooks (core, block, inline) but doesn’t allow deep manipulation of the token stream like markdown-it. Its architecture prioritizes speed over flexibility.
// remarkable: define a custom inline rule
const Remarkable = require('remarkable');
const md = new Remarkable();
md.inline.ruler.push('my_rule', function(state, silent) {
// limited access to parsing state
});
showdown uses a regex-and-replace engine with an extension system based on preprocessors, postprocessors, listeners, and type-specific handlers. It’s less structured than token-based parsers but easier to grasp for simple overrides.
// showdown: create an extension
const showdown = require('showdown');
const converter = new showdown.Converter({
extensions: [{
type: 'output',
filter: function(text) {
return text.replace(/CUSTOM/g, '<b>custom</b>');
}
}]
});
All three libraries do not sanitize HTML by default. If your Markdown includes raw HTML (e.g., <script> tags), it will be rendered as-is — a major XSS risk.
markdown-it encourages safe usage via the html: false option (default) and recommends pairing with a sanitizer like DOMPurify:
const md = require('markdown-it')({ html: false }); // blocks HTML tags
// For trusted HTML + sanitization:
const dirty = md.render('<img src=x onerror=alert(1)>');
const clean = DOMPurify.sanitize(dirty);
remarkable behaves similarly — html: false is default, but you must handle sanitization yourself if enabling HTML.
const md = new Remarkable({ html: false }); // strips HTML
showdown defaults to noHtml: false, meaning HTML is allowed unless explicitly disabled — a potential footgun:
// Dangerous: allows raw HTML by default
const converter = new showdown.Converter();
// Safe: disable HTML
const safeConverter = new showdown.Converter({ noHtml: true });
💡 Always disable raw HTML or sanitize output when rendering untrusted Markdown.
Need to support GitHub-style task lists, LaTeX math, or custom shortcodes? Extensibility becomes critical.
markdown-it shines here with hundreds of official and community plugins (e.g., markdown-it-task-lists, markdown-it-katex). Plugins can hook into parsing, rendering, or both.
const md = require('markdown-it')()
.use(require('markdown-it-task-lists'));
console.log(md.render('- [x] done')); // renders checkbox
remarkable has minimal plugin support. You can write custom rules, but there’s no ecosystem of reusable extensions. The project hasn’t seen significant updates since 2018.
// No official plugins; you build everything from scratch
showdown supports extensions, but they’re less powerful than markdown-it’s plugin system. Extensions can’t easily modify parsing logic — they mostly transform text before or after conversion.
// showdown extension for :emoji:
const emojiExt = {
type: 'lang',
regex: /:([a-z]+):/g,
replace: '<span class="emoji">$1</span>'
};
const converter = new showdown.Converter({ extensions: [emojiExt] });
All three work in Node.js and browsers, but with caveats.
markdown-it is designed for both environments. The core is lightweight, and plugins can be loaded conditionally.
remarkable works in browsers but hasn’t been optimized for modern bundlers. Its last release was years ago.
showdown explicitly supports browsers and even provides a global Showdown.converter. It’s commonly used in client-side editors.
<!-- showdown in browser -->
<script src="showdown.min.js"></script>
<script>
const converter = new showdown.Converter();
document.getElementById('preview').innerHTML =
converter.makeHtml('# Hello');
</script>
markdown-it follows CommonMark closely and passes most of its test suite. It handles edge cases like nested lists, emphasis ambiguity, and code fences reliably.
remarkable also aims for CommonMark compliance but lags behind in updates. Some newer Markdown constructs may not parse correctly.
showdown does not fully comply with CommonMark. It follows its own interpretation, closer to “classic” Markdown or GitHub Flavored Markdown (GFM) depending on options.
// Example: GFM table support
const input = "| a | b |\n|---|---|\n| 1 | 2 |";
// markdown-it: requires markdown-it-tables plugin
// remarkable: built-in support
// showdown: enable 'tables' option
const converter = new showdown.Converter({ tables: true });
markdown-it: Actively maintained, frequent releases, large community.remarkable: No longer under active development (per its GitHub README). Last npm release was in 2018. Not recommended for new projects.showdown: Actively maintained, regular updates, stable API.| Feature | markdown-it | remarkable | showdown |
|---|---|---|---|
| Architecture | Token-based, modular | Token-based, minimal hooks | Regex-based, extension hooks |
| Extensibility | Rich plugin ecosystem | Limited, no plugins | Basic extensions |
| Security Defaults | html: false (safe) | html: false (safe) | noHtml: false (unsafe!) |
| Standards | CommonMark compliant | Partially compliant | Non-compliant (GFM-like) |
| Maintenance | ✅ Active | ❌ Deprecated | ✅ Active |
| Best For | Complex apps, custom syntax | Legacy projects (avoid new) | Simple converters, client-side |
markdown-it. Its plugin system and active maintenance make it the most robust choice.showdown is reliable and easy to drop in.remarkable in new codebases — its lack of updates and plugin support makes it a liability long-term.Remember: no matter which library you choose, always sanitize output when rendering untrusted Markdown to prevent XSS attacks.
Choose markdown-it if you need a highly extensible, standards-compliant Markdown parser with a rich plugin ecosystem. It supports CommonMark and provides fine-grained control over parsing and rendering through rules and plugins. Ideal for applications requiring custom syntax extensions (e.g., math, footnotes) or strict security via HTML sanitization.
Choose showdown if you need a battle-tested, flexible converter with a simple API and good browser support. It includes options for flavor customization (GitHub, vanilla), client-side usage, and extension hooks. While not as fast or modular as markdown-it, it remains actively maintained and suitable for straightforward Markdown-to-HTML conversion in both frontend and backend contexts.
Choose remarkable if you prioritize speed and a clean, minimal API without needing extensive plugin support. It offers solid CommonMark compliance and built-in syntax highlighting but lacks active maintenance—official documentation notes it is no longer under active development. Avoid for new projects unless legacy compatibility is required.
Markdown parser done right. Fast and easy to extend.
Table of content
node.js:
npm install markdown-it
browser (CDN):
See also:
// node.js
// can use `require('markdown-it')` for CJS
import markdownit from 'markdown-it'
const md = markdownit()
const result = md.render('# markdown-it rulezz!');
// browser with UMD build, added to "window" on script load
// Note, there is no dash in "markdownit".
const md = window.markdownit();
const result = md.render('# markdown-it rulezz!');
Single line rendering, without paragraph wrap:
import markdownit from 'markdown-it'
const md = markdownit()
const result = md.renderInline('__markdown-it__ rulezz!');
(*) presets define combinations of active rules and options. Can be
"commonmark", "zero" or "default" (if skipped). See
API docs for more details.
import markdownit from 'markdown-it'
// commonmark mode
const md = markdownit('commonmark')
// default mode
const md = markdownit()
// enable everything
const md = markdownit({
html: true,
linkify: true,
typographer: true
})
// full options list (defaults)
const md = markdownit({
// Enable HTML tags in source
html: false,
// Use '/' to close single tags (<br />).
// This is only for full CommonMark compatibility.
xhtmlOut: false,
// Convert '\n' in paragraphs into <br>
breaks: false,
// CSS language prefix for fenced blocks. Can be
// useful for external highlighters.
langPrefix: 'language-',
// Autoconvert URL-like text to links
linkify: false,
// Enable some language-neutral replacement + quotes beautification
// For the full list of replacements, see https://github.com/markdown-it/markdown-it/blob/master/lib/rules_core/replacements.mjs
typographer: false,
// Double + single quotes replacement pairs, when typographer enabled,
// and smartquotes on. Could be either a String or an Array.
//
// For example, you can use '«»„“' for Russian, '„“‚‘' for German,
// and ['«\xA0', '\xA0»', '‹\xA0', '\xA0›'] for French (including nbsp).
quotes: '“”‘’',
// Highlighter function. Should return escaped HTML,
// or '' if the source string is not changed and should be escaped externally.
// If result starts with <pre... internal wrapper is skipped.
highlight: function (/*str, lang*/) { return ''; }
});
import markdownit from 'markdown-it'
const md = markdownit
.use(plugin1)
.use(plugin2, opts, ...)
.use(plugin3);
Apply syntax highlighting to fenced code blocks with the highlight option:
import markdownit from 'markdown-it'
import hljs from 'highlight.js' // https://highlightjs.org
// Actual default values
const md = markdownit({
highlight: function (str, lang) {
if (lang && hljs.getLanguage(lang)) {
try {
return hljs.highlight(str, { language: lang }).value;
} catch (__) {}
}
return ''; // use external default escaping
}
});
Or with full wrapper override (if you need assign class to <pre> or <code>):
import markdownit from 'markdown-it'
import hljs from 'highlight.js' // https://highlightjs.org
// Actual default values
const md = markdownit({
highlight: function (str, lang) {
if (lang && hljs.getLanguage(lang)) {
try {
return '<pre><code class="hljs">' +
hljs.highlight(str, { language: lang, ignoreIllegals: true }).value +
'</code></pre>';
} catch (__) {}
}
return '<pre><code class="hljs">' + md.utils.escapeHtml(str) + '</code></pre>';
}
});
linkify: true uses linkify-it. To
configure linkify-it, access the linkify instance through md.linkify:
md.linkify.set({ fuzzyEmail: false }); // disables converting email to link
If you are going to write plugins, please take a look at Development info.
Embedded (enabled by default):
Via plugins:
By default all rules are enabled, but can be restricted by options. On plugin load all its rules are enabled automatically.
import markdownit from 'markdown-it'
// Activate/deactivate rules, with currying
const md = markdownit()
.disable(['link', 'image'])
.enable(['link'])
.enable('image');
// Enable everything
const md = markdownit({
html: true,
linkify: true,
typographer: true,
});
You can find all rules in sources:
Here is the result of readme parse at MB Pro Retina 2013 (2.4 GHz):
npm run benchmark-deps
benchmark/benchmark.mjs readme
Selected samples: (1 of 28)
> README
Sample: README.md (7774 bytes)
> commonmark-reference x 1,222 ops/sec ±0.96% (97 runs sampled)
> current x 743 ops/sec ±0.84% (97 runs sampled)
> current-commonmark x 1,568 ops/sec ±0.84% (98 runs sampled)
> marked x 1,587 ops/sec ±4.31% (93 runs sampled)
Note. CommonMark version runs with simplified link normalizers for more "honest" compare. Difference is ≈1.5×.
As you can see, markdown-it doesn't pay with speed for its flexibility.
Slowdown of "full" version caused by additional features not available in
other implementations.
Available as part of the Tidelift Subscription.
The maintainers of markdown-it and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
markdown-it is the result of the decision of the authors who contributed to 99% of the Remarkable code to move to a project with the same authorship but new leadership (Vitaly and Alex). It's not a fork.
Big thanks to John MacFarlane for his work on the CommonMark spec and reference implementations. His work saved us a lot of time during this project's development.
Related Links:
Ports