Convert Markdown to Word

Word style mapping

Markdown elements map to Word styles as follows:

• Headings # H1–###### H6 → Word's Heading 1–Heading 6 styles, with size, color, and spacing tuned for body docs (not slide-deck oversize).
• Bold / italic / strikethrough → matching character runs.
• Ordered and unordered lists → Word's List Paragraph with proper indent levels (decimal, alpha, bullets at nesting depth).
• Tables → proper Word tables with column alignment.
• Code blocks → Courier New, light-grey background, single side-border (Word's closest analog to a code fence).
• Blockquotes → slate left-border on each paragraph.
• Links → real Word hyperlinks. Scheme allowlist on the way in: only http, https, mailto.

Mermaid diagrams (new) feature

Fenced code blocks tagged mermaid in your Markdown are rendered as PNG images and embedded inline in the .docx — centered, scaled to a max of 6 inches wide (fits portrait letter with default margins).

\`\`\`mermaid
sequenceDiagram
  Alice->>Bob: Hi!
  Bob-->>Alice: Hello!
\`\`\`

The diagram travels inside the .docx ZIP as a real PNG part (word/media/...) — Word opens it, Google Docs imports it, the document is portable. Invalid Mermaid syntax falls back to the source as Courier text rather than failing the export. See the Mermaid Editor docs for supported diagram types and syntax.

What does NOT carry

Honest about the edges:

• Images from Markdown ![alt](src): rendered as bracketed alt text only. Fetching the image would mean a network call from your browser — we deliberately don't.
• Interleaved emphasis edge cases like **bold _italic** still italic_ — rare in real prose; can emit unbalanced stack in Word.
• Nested structures inside blockquotes (lists or code fences inside >) collapse to single paragraphs.
• YAML frontmatter is ignored, not stripped — it appears as the first paragraph.

Security posture

This export path was audited for OOXML injection at the 2026-04-18 ship. Key invariants:

• Typed API only. We use the docx library's high-level API exclusively — no raw XML interpolation, no ImportedXmlComponent. Blocks DDE-field and OOXML-injection vectors.
• Formula-injection guard on table cells (CWE-1236). Cells starting with =, +, -, or @ get a zero-width space prefix so Excel/Word do not auto-execute them when the doc is copy-pasted into a spreadsheet.
• Trojan-source character strip — invisible bidi-override and control chars are removed at the input boundary.
• Input caps: 5 MB input, 50-level nesting, 10,000 table cells. Sane defaults — generous enough for any real document, conservative enough that pathological input cannot OOM the tab.

Privacy

Everything runs in your browser. The docx library is vendored — no third-party CDN. Mermaid render (when used) is local too. No analytics, no server-side conversion. Once the page has loaded, the converter works offline.