# marked-escaping-tokenizer

> A custom tokenizer to disable custom HTML in Markdown

Latest version **0.4.0** (published 2026-10-16) · MIT license · 0 weekly downloads

## Install

```sh
npm install marked-escaping-tokenizer
pnpm add marked-escaping-tokenizer
yarn add marked-escaping-tokenizer
bun add marked-escaping-tokenizer
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.4.0 |
| Published | 2026-10-16 |
| First published | 2021-02-08 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 17.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Scitotec GmbH |
| Maintainers | delbertooo |
| Keywords | markdown, marked |

## Links

- npm: https://www.npmjs.com/package/marked-escaping-tokenizer
- Repository: https://github.com/scitotec/marked-escaping-tokenizer
- Homepage: https://github.com/scitotec/marked-escaping-tokenizer#readme
- Issues: https://github.com/scitotec/marked-escaping-tokenizer/issues
- npm.io page: https://npm.io/package/marked-escaping-tokenizer

## Alternatives

- [@mdxeditor/editor](https://npm.io/package/@mdxeditor/editor.md) — 962.4K weekly downloads
- [mmdb-lib](https://npm.io/package/mmdb-lib.md) — 680.9K weekly downloads
- [playcanvas](https://npm.io/package/playcanvas.md) — 36.2K weekly downloads
- [@glw907/cairn-cms](https://npm.io/package/@glw907/cairn-cms.md) — 967 weekly downloads
- [markdown-to-confluence](https://npm.io/package/markdown-to-confluence.md) — 103 weekly downloads

## Recent versions

- 0.4.0 (latest) — 2026-10-16
- 0.3.2 — 2026-10-16
- 0.3.1 — 2025-06-10
- 0.3.0 — 2025-02-26
- 0.2.0 — 2025-01-22
- 0.1.2 — 2022-04-04
- 0.1.1 — 2022-04-04
- 0.1.0 — 2022-04-04
- 0.0.1 — 2021-02-08

## README

[![npm version](https://img.shields.io/npm/v/marked-escaping-tokenizer.svg)](https://www.npmjs.com/package/marked-escaping-tokenizer)
[![license](https://img.shields.io/npm/l/marked-escaping-tokenizer.svg)](./LICENSE)

# marked-escaping-tokenizer
A custom tokenizer to disable custom HTML in [Marked Markdown](https://www.npmjs.com/package/marked) made by [Scitotec GmbH](https://scitotec.de).

## Why?

Because we like to use markdown as a simple markup language without the preordained target HTML. The target might be a PDF or something completely different. None of these other targets support HTML.

Another reason is, that generally escaped Markdown provides a much more secure way to render markdown input by users which may not be trusted.

Escaping HTML is not a complete sanitizer, though: marked still renders links like `[click](javascript:alert(1))` as they are. If you show untrusted input in a browser, use a Content Security Policy that forbids inline scripts, which blocks such links, or sanitize the resulting HTML, e.g. with [DOMPurify](https://www.npmjs.com/package/dompurify).

## How to use it with Marked?

You can just create a new `EscapingTokenizer` with an escaper of your choice. We bundle [escape-html](https://www.npmjs.com/package/escape-html) as a default escaper for you.

Install with your package manager:

```bash
npm install --save marked-escaping-tokenizer
```

Configure and use:

```js
import { EscapingTokenizer } from 'marked-escaping-tokenizer'
import { marked } from 'marked'

// init your tokenizer
const tokenizer = new EscapingTokenizer()

// use marked as you wish
const html = marked.parse(input, { tokenizer })
```

Works with marked 4 up to 18. marked 16 and later are ESM only; to `require()` them from CommonJS you need Node.js 20.19+ or 22.12+.

## Advanced usage

### Configure the html escaper

You can swap out the default escaper for an escaper of your choice to escape html in a given string:

```js
import { EscapingTokenizer } from 'marked-escaping-tokenizer'
import { marked } from 'marked'

// init your tokenizer
const tokenizer = new EscapingTokenizer()
tokenizer.escaper = (s) => s.replaceAll('<', '&lt;')


// use marked as you wish
const html = marked.parse(input, { tokenizer })
```


## Publishing

```
npm version <major|minor|patch>
npm run build
git push <version>
git push
npm publish
```

---
_Source: https://npm.io/package/marked-escaping-tokenizer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._