跪拜 Guibai
← All articles
Frontend

Markdown vs. Marked: One Is a Language, One Is a Parser—Here's How to Use Both

By excel ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Front-end developers routinely confuse the two, and the distinction shapes how content pipelines are built. Knowing that Marked is a parser—not a language—saves wasted time hunting for a Markdown interpreter or expecting Markdown itself to render HTML, and it flags the security gap of unsanitized user-supplied Markdown.

Summary

Names collide in the front-end world: Markdown and Marked sound interchangeable, but they sit on opposite sides of the content pipeline. Markdown is a lightweight markup language for structuring text with symbols, while Marked is a JavaScript library that converts that Markdown text into HTML. The distinction matters because they are not competing alternatives—they work together.

A typical flow starts with Markdown-authored content, passes it through `marked.parse()`, and serves the resulting HTML to the browser. Marked ships as an npm package and targets JavaScript environments, whereas Markdown itself has no dependency on any language. The choice is a question of role: write content in Markdown, parse it with Marked when the project runs on JS.

One practical warning stands out: Marked does not sanitize HTML by default. Any Markdown coming from user input can carry malicious tags or scripts into the generated HTML. The article recommends piping the output through DOMPurify before inserting it into the page, with the decision to sanitize hinging on the content's source and display context.

Takeaways
— Markdown is a lightweight markup language; Marked is a JavaScript Markdown parser library.
— Markdown has no programming language dependency; Marked is used mainly in JavaScript environments and distributed as an npm package.
— The two are not alternatives—a common workflow is Markdown text, parsed by Marked, rendered as HTML.
— Marked's output should not be assumed safe; user-supplied Markdown can produce HTML containing malicious tags or scripts.
— Using a sanitizer like DOMPurify on the parsed HTML is recommended before inserting it into a page.
— Whether sanitization is needed depends on the content source and how it is displayed; user-submitted content generally requires it.
Conclusions

The naming overlap causes real confusion among front-end developers, so a clear mental model of 'language vs. tool' prevents misdirected searches and wrong API calls.

The security warning is the most actionable part: many developers assume popular parsers automatically escape unsafe input, but Marked deliberately leaves sanitization to separate tools.

The article's analogy of Markdown as a writing format and Marked as a converter captures the division of labor that makes the pair feel natural once explained.

Concepts & terms
Markdown
A lightweight markup language that uses plain-text symbols to denote headings, lists, links, and code blocks. Files commonly use .md or .markdown extensions.
Marked
A JavaScript library that parses Markdown text and converts it to HTML. Commonly used in web apps, Node.js services, and build scripts.
HTML sanitizer
A tool that strips or neutralizes unsafe scripts and tags from HTML, for example DOMPurify, used to prevent XSS when rendering user-generated Markdown.
From the discussion
Featured comments
卷土的土

Parsing and sanitization should be handled separately.

excel

What do you mean? Both can parse, markd uses a bit less memory.

excel

It's markdown.js that takes up a lot of memory.

See top comments, translated →
Source: juejin.cn ↗ Google Translate ↗ Backup ↗