Markdown parser, done right. 100% CommonMark support, extensions, syntax plugins & high speed
Installations
npm install markdown-it
Developer Guide
Typescript
No
Module System
CommonJS, ESM
Node Version
20.11.0
NPM Version
10.2.4
Score
98.7
Supply Chain
99.6
Quality
76.8
Maintenance
100
Vulnerability
99.6
License
Releases
Unable to fetch releases
Contributors
Languages
JavaScript (97.11%)
HTML (1.73%)
CSS (1.16%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
Download Statistics
Total Downloads
1,018,814,777
Last Day
348,939
Last Week
7,396,769
Last Month
29,152,758
Last Year
317,381,136
GitHub Statistics
MIT License
18,894 Stars
1,132 Commits
1,731 Forks
178 Watchers
2 Branches
84 Contributors
Updated on Feb 16, 2025
Bundle Size
136.28 kB
Minified
54.03 kB
Minified + Gzipped
Package Meta Information
Latest Version
14.1.0
Package Id
markdown-it@14.1.0
Unpacked Size
749.41 kB
Size
213.35 kB
File Count
60
NPM Version
10.2.4
Node Version
20.11.0
Published on
Mar 18, 2024
Total Downloads
Cumulative downloads
Total Downloads
1,018,814,777
Last Day
-7.2%
348,939
Compared to previous day
Last Week
3.5%
7,396,769
Compared to previous week
Last Month
33.6%
29,152,758
Compared to previous month
Last Year
16.4%
317,381,136
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
6
Dev Dependencies
31
markdown-it
Markdown parser done right. Fast and easy to extend.
- Follows the CommonMark spec + adds syntax extensions & sugar (URL autolinking, typographer).
- Configurable syntax! You can add new rules and even replace existing ones.
- High speed.
- Safe by default.
- Community-written plugins and other packages on npm.
Table of content
- Install
- Usage examples
- API
- Syntax extensions
- Benchmark
- markdown-it for enterprise
- Authors
- References / Thanks
Install
node.js:
1npm install markdown-it
browser (CDN):
Usage examples
See also:
- API documentation - for more info and examples.
- Development info - for plugins writers.
Simple
1// node.js 2// can use `require('markdown-it')` for CJS 3import markdownit from 'markdown-it' 4const md = markdownit() 5const result = md.render('# markdown-it rulezz!'); 6 7// browser with UMD build, added to "window" on script load 8// Note, there is no dash in "markdownit". 9const md = window.markdownit(); 10const result = md.render('# markdown-it rulezz!');
Single line rendering, without paragraph wrap:
1import markdownit from 'markdown-it' 2const md = markdownit() 3const result = md.renderInline('__markdown-it__ rulezz!');
Init with presets and options
(*) presets define combinations of active rules and options. Can be
"commonmark"
, "zero"
or "default"
(if skipped). See
API docs for more details.
1import markdownit from 'markdown-it' 2 3// commonmark mode 4const md = markdownit('commonmark') 5 6// default mode 7const md = markdownit() 8 9// enable everything 10const md = markdownit({ 11 html: true, 12 linkify: true, 13 typographer: true 14}) 15 16// full options list (defaults) 17const md = markdownit({ 18 // Enable HTML tags in source 19 html: false, 20 21 // Use '/' to close single tags (<br />). 22 // This is only for full CommonMark compatibility. 23 xhtmlOut: false, 24 25 // Convert '\n' in paragraphs into <br> 26 breaks: false, 27 28 // CSS language prefix for fenced blocks. Can be 29 // useful for external highlighters. 30 langPrefix: 'language-', 31 32 // Autoconvert URL-like text to links 33 linkify: false, 34 35 // Enable some language-neutral replacement + quotes beautification 36 // For the full list of replacements, see https://github.com/markdown-it/markdown-it/blob/master/lib/rules_core/replacements.mjs 37 typographer: false, 38 39 // Double + single quotes replacement pairs, when typographer enabled, 40 // and smartquotes on. Could be either a String or an Array. 41 // 42 // For example, you can use '«»„“' for Russian, '„“‚‘' for German, 43 // and ['«\xA0', '\xA0»', '‹\xA0', '\xA0›'] for French (including nbsp). 44 quotes: '“”‘’', 45 46 // Highlighter function. Should return escaped HTML, 47 // or '' if the source string is not changed and should be escaped externally. 48 // If result starts with <pre... internal wrapper is skipped. 49 highlight: function (/*str, lang*/) { return ''; } 50});
Plugins load
1import markdownit from 'markdown-it' 2 3const md = markdownit 4 .use(plugin1) 5 .use(plugin2, opts, ...) 6 .use(plugin3);
Syntax highlighting
Apply syntax highlighting to fenced code blocks with the highlight
option:
1import markdownit from 'markdown-it' 2import hljs from 'highlight.js' // https://highlightjs.org 3 4// Actual default values 5const md = markdownit({ 6 highlight: function (str, lang) { 7 if (lang && hljs.getLanguage(lang)) { 8 try { 9 return hljs.highlight(str, { language: lang }).value; 10 } catch (__) {} 11 } 12 13 return ''; // use external default escaping 14 } 15});
Or with full wrapper override (if you need assign class to <pre>
or <code>
):
1import markdownit from 'markdown-it' 2import hljs from 'highlight.js' // https://highlightjs.org 3 4// Actual default values 5const md = markdownit({ 6 highlight: function (str, lang) { 7 if (lang && hljs.getLanguage(lang)) { 8 try { 9 return '<pre><code class="hljs">' + 10 hljs.highlight(str, { language: lang, ignoreIllegals: true }).value + 11 '</code></pre>'; 12 } catch (__) {} 13 } 14 15 return '<pre><code class="hljs">' + md.utils.escapeHtml(str) + '</code></pre>'; 16 } 17});
Linkify
linkify: true
uses linkify-it. To
configure linkify-it, access the linkify instance through md.linkify
:
1md.linkify.set({ fuzzyEmail: false }); // disables converting email to link
API
If you are going to write plugins, please take a look at Development info.
Syntax extensions
Embedded (enabled by default):
- Tables (GFM)
- Strikethrough (GFM)
Via plugins:
- subscript
- superscript
- footnote
- definition list
- abbreviation
- emoji
- custom container
- insert
- mark
- ... and others
Manage rules
By default all rules are enabled, but can be restricted by options. On plugin load all its rules are enabled automatically.
1import markdownit from 'markdown-it' 2 3// Activate/deactivate rules, with currying 4const md = markdownit() 5 .disable(['link', 'image']) 6 .enable(['link']) 7 .enable('image'); 8 9// Enable everything 10const md = markdownit({ 11 html: true, 12 linkify: true, 13 typographer: true, 14});
You can find all rules in sources:
Benchmark
Here is the result of readme parse at MB Pro Retina 2013 (2.4 GHz):
1npm run benchmark-deps 2benchmark/benchmark.mjs readme 3 4Selected samples: (1 of 28) 5 > README 6 7Sample: README.md (7774 bytes) 8 > commonmark-reference x 1,222 ops/sec ±0.96% (97 runs sampled) 9 > current x 743 ops/sec ±0.84% (97 runs sampled) 10 > current-commonmark x 1,568 ops/sec ±0.84% (98 runs sampled) 11 > marked x 1,587 ops/sec ±4.31% (93 runs sampled)
Note. CommonMark version runs with simplified link normalizers for more "honest" compare. Difference is ≈1.5×.
As you can see, markdown-it
doesn't pay with speed for its flexibility.
Slowdown of "full" version caused by additional features not available in
other implementations.
markdown-it for enterprise
Available as part of the Tidelift Subscription.
The maintainers of markdown-it
and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
Authors
- Alex Kocharin github/rlidwka
- Vitaly Puzrin github/puzrin
markdown-it is the result of the decision of the authors who contributed to 99% of the Remarkable code to move to a project with the same authorship but new leadership (Vitaly and Alex). It's not a fork.
References / Thanks
Big thanks to John MacFarlane for his work on the CommonMark spec and reference implementations. His work saved us a lot of time during this project's development.
Related Links:
- https://github.com/jgm/CommonMark - reference CommonMark implementations in C & JS, also contains latest spec & online demo.
- http://talk.commonmark.org - CommonMark forum, good place to collaborate developers' efforts.
Ports
- motion-markdown-it - Ruby/RubyMotion
- markdown-it-py- Python
Stable Version
Stable Version
14.1.0
High
1
7.5/10
Summary
markdown-it vulnerable to Inefficient Regular Expression Complexity
Affected Versions
< 3.0.0
Patched Versions
3.0.0
Moderate
1
5.3/10
Summary
Uncontrolled Resource Consumption in markdown-it
Affected Versions
< 12.3.2
Patched Versions
12.3.2
Reason
3 commit(s) out of 30 and 13 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
no vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy detected in current repo: docs/security.md:1
Reason
update tool detected
Details
- Info: Dependabot detected: .github/dependabot.yml:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: : LICENSE:1
Reason
no binaries found in the repo
Reason
dependency not pinned by hash detected -- score normalized to 7
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/l-orlov/task-tracker/ci.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/l-orlov/task-tracker/ci.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/l-orlov/task-tracker/ci.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:27
- Info: Dockerfile dependencies are pinned
- Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
- Info: no insecure (not pinned by hash) dependency downloads found in shell scripts
Reason
GitHub code reviews found for 10 commits out of the last 30 -- score normalized to 3
Details
- Warn: no reviews found for commit: 1529ff4944329eb8080a8558dab85164b6c212cd
- Warn: no reviews found for commit: 6325878f9fa7dba17c8af1c5f190a455191495aa
- Warn: no reviews found for commit: 9ff460ef878e762443954fc9776743f60db031f3
- Warn: no reviews found for commit: e843acc9edad115cbf8cf85e676443f01658be08
- Warn: no reviews found for commit: bda718216b20fa03b725443b8a1d160a0baeb94f
- Warn: no reviews found for commit: b8b610fd7ae2783cee110539b5429d9b09671409
- Warn: no reviews found for commit: d17df137d08e0cf989c21223dfbb420fac929a51
- Warn: no reviews found for commit: 6ec0b76ebe439f5858ae51d8e0cb45ee4a7ad46c
- Warn: no reviews found for commit: 0e4c0f47a9ef87c07016a1f39b817dd3585eb19b
- Warn: no reviews found for commit: d1757ed98b57d17b2656c6abe314efdccabc9732
- Warn: no reviews found for commit: f52351499be1e6c838110c31e07154cce1d91d47
- Warn: no reviews found for commit: 3fc0deb38b5a8b2eb8f46c727cc4e299e5ae5f9c
- Warn: no reviews found for commit: 6b58ec4245abe2e293c79bd7daabf4543ef46399
- Warn: no reviews found for commit: 75037c6514e99c9b4fa300f62f04913fee4ea0e2
- Warn: no reviews found for commit: 7edd820b57a7018a9886b6b2efacc9bdae20ca98
- Warn: no reviews found for commit: df77ca12fb9424867643de251f80d0c6d0f876cf
- Warn: no reviews found for commit: 6a5bf2d41b9a9d3dabff0d3ade03f7250c1021a4
- Warn: no reviews found for commit: d67155cbc97c355dcdd682c15935539d2df6ec5b
- Warn: no reviews found for commit: d72c68b520cedacae7878caa92bf7fe32e3e0e6f
- Warn: no reviews found for commit: aca33963612b27d4c25d5051c5fb7ba986598686
Reason
no badge detected
Reason
non read-only tokens detected in GitHub workflows
Details
- Warn: no topLevel permission defined: .github/workflows/ci.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/l-orlov/task-tracker/ci.yml/main?enable=permissions
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
project is not fuzzed
Score
6.5
/10
Last Scanned on 2022-08-15
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More