Gathering detailed insights and metrics for showdown
A bidirectional Markdown to HTML to Markdown converter written in Javascript
Installations
npm install showdownDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Node Version
17.8.0
NPM Version
8.5.5
Score
98.9
Supply Chain
100
Quality
78.3
Maintenance
100
Vulnerability
100
License
Releases
54
Contributors
77
Unable to fetch Contributors
Languages
2
JavaScript
HTML
JavaScript (73.45%)
HTML (26.55%)
validate.email 🚀
Verify real, reachable, and deliverable emails with instant MX records, SMTP checks, and disposable email detection.
Developer
Download Statistics
Total Downloads
134,918,174
Last Day
46,613
Last Week
636,366
Last Month
2,998,911
Last Year
34,365,001
GitHub Statistics
MIT License
14,502 Stars
916 Commits
1,565 Forks
191 Watchers
16 Branches
77 Contributors
Updated on Mar 15, 2025
Bundle Size
74.24 kB
Minified
23.67 kB
Minified + Gzipped
Sponsor this package
Maintainers
2
Package Meta Information
Latest Version
2.1.0
Package Id
showdown@2.1.0
Unpacked Size
781.76 kB
Size
162.34 kB
File Count
8
NPM Version
8.5.5
Node Version
17.8.0
Total Downloads
Cumulative downloads
Total Downloads
134,918,174
Last Day
20.7%
46,613
Compared to previous day
Last Week
-16%
636,366
Compared to previous week
Last Month
-3.5%
2,998,911
Compared to previous month
Last Year
37.3%
34,365,001
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Dev Dependencies
20
Showdown is a Javascript Markdown to HTML converter, based on the original works by John Gruber. Showdown can be used client side (in the browser) or server side (with NodeJs).
Live DEMO
Check a live Demo here http://demo.showdownjs.com/
Funding
As you know, ShowdownJS is a free library and it will remain free forever. However, maintaining and improving the library costs time and money.
If you like our work and find our library useful, please donate through paypal!! Your contribution will be greatly appreciated and help us continue to develop this awesome library.
License
ShowdownJS v 2.0 is release under the MIT version. Previous versions are release under BSD.
Who uses Showdown (or a fork)
- GoogleCloudPlatform
- Meteor
- Stackexchange - forked as PageDown
- docular
- md-page
- QCObjects
- and some others...
Installation
Download tarball
You can download the latest release tarball directly from releases
Bower
bower install showdown
npm (server-side)
npm install showdown
NuGet package
PM> Install-Package showdownjs
The NuGet Packages can be found here.
CDN
You can also use one of several CDNs available:
-
jsDelivr
https://cdn.jsdelivr.net/npm/showdown@<version tag>/dist/showdown.min.js -
cdnjs
https://cdnjs.cloudflare.com/ajax/libs/showdown/<version tag>/showdown.min.js -
unpkg
https://unpkg.com/showdown/dist/showdown.min.js
Note: replace <version tag> with an actual full length version you're interested in e.g. 1.9.0
Browser Compatibility
Showdown has been tested successfully with:
- Firefox 1.5 and 2.0
- Chrome 12.0
- Internet Explorer 6 and 7
- Safari 2.0.4
- Opera 8.54 and 9.10
- Netscape 8.1.2
- Konqueror 3.5.4
In theory, Showdown will work in any browser that supports ECMA 262 3rd Edition (JavaScript 1.5). The converter itself might even work in things that aren't web browsers, like Acrobat. No promises.
Node compatibility
Showdown supports node versions in the "Current", "Active" and "Maintenance" phases. Currently this includes Node 12.x, 14.x, 16.x and 17.x. See the [node release roadmap for more details](12.x, 14.x, 16.x, 17.x).
Other versions of node may likely work, but they are not tested regularly.
Pervious versions
If you're looking for showdown v<1.0.0, you can find it in the legacy branch.
If you are looking for showdown 1.* you can find it in the [version_1.x][version_1.x] branch.
Changelog
You can check the full changelog
Extended documentation
Check our wiki pages for examples and a more in-depth documentation.
Quick Example
Node
Markdown to HTML
1var showdown = require('showdown'), 2 converter = new showdown.Converter(), 3 text = '# hello, markdown!', 4 html = converter.makeHtml(text);
HTML to Markdown
1var showdown = require('showdown'), 2 converter = new showdown.Converter(), 3 html = '<a href="https://patreon.com/showdownjs">Please Support us!</a>', 4 md = converter.makeMarkdown(text);
Browser
1var converter = new showdown.Converter(),
2 html = converter.makeHtml('# hello, markdown!'),
3 md = converter.makeMd('<a href="https://patreon.com/showdownjs">Please Support us!</a>');Output
Both examples should output...
1 <h1 id="hellomarkdown">hello, markdown!</h1>
1[Please Support us!](https://patreon.com/showdownjs)
Options
You can change some of showdown's default behavior through options.
Setting options
Options can be set:
Globally
Setting a "global" option affects all instances of showdown
1showdown.setOption('optionKey', 'value');
Locally
Setting a "local" option only affects the specified Converter object. Local options can be set:
-
through the constructor
1var converter = new showdown.Converter({optionKey: 'value'}); -
through the setOption() method
1var converter = new showdown.Converter(); 2converter.setOption('optionKey', 'value');
Getting an option
Showdown provides 2 methods (both local and global) to retrieve previous set options.
getOption()
1// Global 2var myOption = showdown.getOption('optionKey'); 3 4//Local 5var myOption = converter.getOption('optionKey');
getOptions()
1// Global 2var showdownGlobalOptions = showdown.getOptions(); 3 4//Local 5var thisConverterSpecificOptions = converter.getOptions();
Retrieve the default options
You can get showdown's default options with:
1var defaultOptions = showdown.getDefaultOptions();
Valid Options
-
omitExtraWLInCodeBlocks: (boolean) [default false] Omit the trailing newline in a code block. Ex:
This:
1<code><pre>var foo = 'bar'; 2</pre></code>Becomes this:
1<code><pre>var foo = 'bar';</pre></code> -
noHeaderId: (boolean) [default false] Disable the automatic generation of header ids. Setting to true overrides prefixHeaderId
-
customizedHeaderId: (boolean) [default false] Use text in curly braces as header id. (since v1.7.0) Example:
## Sample header {real-id} will use real-id as id -
ghCompatibleHeaderId: (boolean) [default false] Generate header ids compatible with github style (spaces are replaced with dashes and a bunch of non alphanumeric chars are removed) (since v1.5.5)
-
prefixHeaderId: (string/boolean) [default false] Add a prefix to the generated header ids. Passing a string will prefix that string to the header id. Setting to
truewill add a generic 'section' prefix. -
rawPrefixHeaderId: (boolean) [default false] Setting this option to true will prevent showdown from modifying the prefix. This might result in malformed IDs (if, for instance, the " char is used in the prefix). Has no effect if prefixHeaderId is set to false. (since v 1.7.3)
-
rawHeaderId: (boolean) [default false] Remove only spaces, ' and " from generated header ids (including prefixes), replacing them with dashes (-). WARNING: This might result in malformed ids (since v1.7.3)
-
parseImgDimensions: (boolean) [default false] Enable support for setting image dimensions from within markdown syntax. Examples:
 simple, assumes units are in px  sets the height to "auto"  Image with width of 80% and height of 5em -
headerLevelStart: (integer) [default 1] Set the header starting level. For instance, setting this to 3 means that
1# foowill be parsed as
1<h3>foo</h3> -
simplifiedAutoLink: (boolean) [default false] Turning this option on will enable automatic linking to urls. This means that:
1some text www.google.comwill be parsed as
1<p>some text <a href="www.google.com">www.google.com</a> -
excludeTrailingPunctuationFromURLs: (boolean) [default false] This option excludes trailing punctuation from autolinking urls. Punctuation excluded:
. ! ? ( ). Only applies if simplifiedAutoLink option is set totrue.1check this link www.google.com!will be parsed as
1<p>check this link <a href="www.google.com">www.google.com</a>!</p> -
literalMidWordUnderscores: (boolean) [default false] Turning this on will stop showdown from interpreting underscores in the middle of words as
<em>and<strong>and instead treat them as literal underscores.Example:
1some text with__underscores__in middlewill be parsed as
1<p>some text with__underscores__in middle</p> -
literalMidWordAsterisks: (boolean) [default false] Turning this on will stop showdown from interpreting asterisks in the middle of words as
<em>and<strong>and instead treat them as literal asterisks.Example:
1some text with**underscores**in middlewill be parsed as
1<p>some text with**underscores**in middle</p> -
strikethrough: (boolean) [default false] Enable support for strikethrough syntax.
~~strikethrough~~as<del>strikethrough</del> -
tables: (boolean) [default false] Enable support for tables syntax. Example:
1| h1 | h2 | h3 | 2|:------|:-------:|--------:| 3| 100 | [a][1] | ![b][2] | 4| *foo* | **bar** | ~~baz~~ |See the wiki for more info
-
tablesHeaderId: (boolean) [default false] If enabled adds an id property to table headers tags.
-
ghCodeBlocks: (boolean) [default true] Enable support for GFM code block style.
-
tasklists: (boolean) [default false] Enable support for GFM tasklists. Example:
1 - [x] This task is done 2 - [ ] This is still pending -
smoothLivePreview: (boolean) [default false] Prevents weird effects in live previews due to incomplete input
-
smartIndentationFix: (boolean) [default false] Tries to smartly fix indentation problems related to es6 template strings in the midst of indented code.
-
disableForced4SpacesIndentedSublists: (boolean) [default false] Disables the requirement of indenting sublists by 4 spaces for them to be nested, effectively reverting to the old behavior where 2 or 3 spaces were enough. (since v1.5.0)
-
simpleLineBreaks: (boolean) [default false] Parses line breaks as
<br>, like GitHub does, without needing 2 spaces at the end of the line (since v1.5.1)1a line 2wrapped in twoturns into:
1<p>a line<br> 2wrapped in two</p> -
requireSpaceBeforeHeadingText: (boolean) [default false] Makes adding a space between
#and the header text mandatory (since v1.5.3) -
ghMentions: (boolean) [default false] Enables github @mentions, which link to the username mentioned (since v1.6.0)
-
ghMentionsLink: (string) [default
https://github.com/{u}] Changes the link generated by @mentions. Showdown will replace{u}with the username. Only applies if ghMentions option is enabled. Example:@tiviewith ghMentionsOption set to//mysite.com/{u}/profilewill result in<a href="//mysite.com/tivie/profile">@tivie</a> -
encodeEmails: (boolean) [default true] Enable e-mail addresses encoding through the use of Character Entities, transforming ASCII e-mail addresses into its equivalent decimal entities. (since v1.6.1)
NOTE: Prior to version 1.6.1, emails would always be obfuscated through dec and hex encoding.
-
openLinksInNewWindow: (boolean) [default false] Open all links in new windows (by adding the attribute
target="_blank"to<a>tags) (since v1.7.0) -
backslashEscapesHTMLTags: (boolean) [default false] Support for HTML Tag escaping. ex:
\<div>foo\</div>(since v1.7.2) -
emoji: (boolean) [default false] Enable emoji support. Ex:
this is a :smile: emojiFor more info on available emojis, see https://github.com/showdownjs/showdown/wiki/Emojis (since v.1.8.0) -
underline: (boolean) [default false] EXPERIMENTAL FEATURE Enable support for underline. Syntax is double or triple underscores ex:
__underlined word__. With this option enabled, underscores are no longer parses into<em>and<strong>. -
ellipsis: (boolean) [default true] Replaces three dots with the ellipsis unicode character.
-
completeHTMLDocument: (boolean) [default false] Outputs a complete html document, including
<html>,<head>and<body>tags' instead of an HTML fragment. (since v.1.8.5) -
metadata: (boolean) [default false] Enable support for document metadata (defined at the top of the document between
«««and»»»or between---and---). (since v.1.8.5)1var conv = new showdown.Converter({metadata: true}); 2var html = conv.makeHtml(someMd); 3var metadata = conv.getMetadata(); // returns an object with the document metadata -
splitAdjacentBlockquotes: (boolean) [default false] Split adjacent blockquote blocks.(since v.1.8.6)
NOTE: Please note that until version 1.6.0, all of these options are DISABLED by default in the cli tool.
Flavors
You can also use flavors or presets to set the correct options automatically, so that showdown behaves like popular markdown flavors.
Currently, the following flavors are available:
- original - original markdown flavor as in John Gruber's spec
- vanilla - showdown base flavor (as from v1.3.1)
- github - GFM (GitHub Flavored Markdown)
Global
1showdown.setFlavor('github');
Instance
1converter.setFlavor('github');
CLI Tool
Showdown also comes bundled with a Command Line Interface tool. You can check the CLI wiki page for more info
Integration with AngularJS
ShowdownJS project also provides seamlessly integration with AngularJS via a "plugin". Please visit https://github.com/showdownjs/ngShowdown for more information.
Integration with TypeScript
If you're using TypeScript you maybe want to use the types from DefinitelyTyped
Integration with SystemJS/JSPM
Integration with SystemJS can be obtained via the third party "system-md" plugin.
Integration with VueJS
To use ShowdownJS as a Vue component quickly, you can check vue-showdown.
XSS vulnerability
Showdown doesn't sanitize the input. This is by design since markdown relies on it to allow certain features to be correctly parsed into HTML. This, however, means XSS injection is quite possible.
Please refer to the wiki article Markdown's XSS Vulnerability (and how to mitigate it) for more information.
Extensions
Showdown allows additional functionality to be loaded via extensions. (you can find a list of known showdown extensions here) You can also find a boilerplate, to create your own extensions in this repository
Client-side Extension Usage
1<script src="showdown.js"></script> 2<script src="twitter-extension.js"></script> 3<script> 4var converter = new showdown.Converter({ extensions: ['twitter'] }); 5</script>
Server-side Extension Usage
1var showdown = require('showdown'), 2 myExtension = require('myExtension'), 3 converter = new showdown.Converter({ extensions: ['myExtension'] });
Tests
A suite of tests is available which require node.js. Once node is installed, run the following command from the project root to install the dependencies:
npm install
Once installed the tests can be run from the project root using:
npm test
New test cases can easily be added. Create a markdown file (ending in .md) which contains the markdown to test.
Create a .html file of the exact same name. It will automatically be tested when the tests are executed with mocha.
Contributing
If you wish to contribute please read the following quick guide.
Want a Feature?
You can request a new feature by submitting an issue. If you would like to implement a new feature feel free to issue a Pull Request.
Pull requests (PRs)
PRs are awesome. However, before you submit your pull request consider the following guidelines:
-
Search GitHub for an open or closed Pull Request that relates to your submission. You don't want to duplicate effort.
-
When issuing PRs that change code, make your changes in a new git branch based on master:
1git checkout -b my-fix-branch master -
Documentation (i.e: README.md) changes can be made directly against master.
-
Run the full test suite before submitting and make sure all tests pass (obviously =P).
-
Try to follow our coding style rules. Breaking them prevents the PR to pass the tests.
-
Refrain from fixing multiple issues in the same pull request. It's preferable to open multiple small PRs instead of one hard to review big one.
-
If the PR introduces a new feature or fixes an issue, please add the appropriate test case.
-
We use commit notes to generate the changelog. It's extremely helpful if your commit messages adhere to the AngularJS Git Commit Guidelines.
-
If we suggest changes then:
- Make the required updates.
- Re-run the Angular test suite to ensure tests are still passing.
- Rebase your branch and force push to your GitHub repository (this will update your Pull Request):
1git rebase master -i 2git push origin my-fix-branch -f -
After your pull request is merged, you can safely delete your branch.
If you have time to contribute to this project, we feel obliged that you get credit for it. These rules enable us to review your PR faster and will give you appropriate credit in your GitHub profile. We thank you in advance for your contribution!
Joining the team
We're looking for members to help maintaining Showdown. Please see this issue to express interest or comment on this note.
Credits
Full credit list at https://github.com/showdownjs/showdown/blob/master/CREDITS.md
Showdown is powered by:
Stable Version
Stable Version
2.1.0
Low
1
Low
3.1/10
Summary
Reverse Tabnabbing in showdown
Affected Versions
< 1.9.1
Patched Versions
1.9.1
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
SAST tool detected but not run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Warn: 0 commits out of 10 are checked with a SAST tool
Reason
dependency not pinned by hash detected -- score normalized to 2
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browserstack.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/browserstack.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/browserstack.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/browserstack.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/browserstack.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/browserstack.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/docs.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.linux.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/node.linux.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.linux.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/node.linux.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.win.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/node.win.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.win.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/showdownjs/showdown/node.win.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/browserstack.yml:23
- Warn: npmCommand not pinned by hash: .github/workflows/node.linux.yml:27
- Info: 0 out of 11 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 4 third-party GitHubAction dependencies pinned
- Info: 2 out of 4 npmCommand dependencies pinned
Reason
Found 4/25 approved changesets -- score normalized to 1
Reason
dangerous workflow patterns detected
Details
- Warn: script injection with untrusted input ' github.event.head_commit.message ': .github/workflows/browserstack.yml:16
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:28
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:29
- Warn: no topLevel permission defined: .github/workflows/browserstack.yml:1
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/docs.yml:1
- Warn: no topLevel permission defined: .github/workflows/node.linux.yml:1
- Warn: no topLevel permission defined: .github/workflows/node.win.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact 2.0.0 not signed: https://api.github.com/repos/showdownjs/showdown/releases/59662522
- Warn: release artifact 2.0.0 does not have provenance: https://api.github.com/repos/showdownjs/showdown/releases/59662522
Reason
25 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-ff7x-qrg7-qggm
- Warn: Project is vulnerable to: GHSA-r7qp-cfhv-p84w
- Warn: Project is vulnerable to: GHSA-q9mw-68c2-j6m5
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
- Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
2.5
/10
Last Scanned on 2025-03-10
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More