Overview
Converts BBCode - the [b], [url], [list] markup used by phpBB, XenForo, and countless forums - into clean HTML, with a live rendered preview and the raw HTML source alongside. Input is HTML-escaped before any tag is processed, so pasted content can never inject markup, and javascript: URLs are neutralised automatically.
How It Works
Paste BBCode on the left; the rendered preview and the generated HTML source update as you type. The preview shows exactly how a browser will treat the output, and the source panel is click-to-copy for pasting into a template, email builder, or CMS field. Unsupported tags are left as plain text rather than dropped, so nothing silently disappears.
Step-by-Step Usage Guide
- Paste your BBCode snippet into the left panel.
- Check the rendered preview to confirm links, lists, and formatting came through as intended.
- Copy the HTML source from the lower panel.
- Paste it into your CMS, template, or export target, and keep the original BBCode as the editable source of truth.
Technical Specifications & Standards
The converter works in two passes that exist for safety as much as correctness. First the entire input is HTML-escaped - ampersands, angle brackets, and quotes - so a script tag in the input can only ever appear as escaped text in the output. Then the tag grammar is applied with a defined replacement set: b, i, u, and s to strong, em, u, and del; code and quote to code and blockquote; size and color to styled spans; url and img to anchor and image elements with rel="noopener noreferrer nofollow"; list and list=1 to ul and ol built from their [*] items; and center to a text-align wrapper. A final guard rewrites any href or src that begins with javascript: to a harmless fragment. That is the difference between this and naive regex examples found online, which happily produce XSS on forum data. The trade-off is honesty about nesting: straightforward nesting works, but pathological interleavings of the same tag are handled by ordered replacement, not a full parser.
Targeted Use Cases
- Migrating old forum posts to a modern CMS that expects HTML.
- Rendering user-submitted BBCode safely in a custom viewer or archive site.
- Converting a signature or announcement written in BBCode into an email-friendly HTML fragment.
- Understanding what a BBCode snippet actually renders before quoting it somewhere else.
Notes & Gotchas
- Always render the preview before publishing converted output - it shows precisely what a browser will do.
- Keep BBCode as your source format and reconvert when editing; converting HTML back to BBCode is lossy.
- The output is escaped and script-safe, but review image URLs if you embed the result on a public page.
- For deeply nested documents, test a sample first; exotic interleavings may not collapse the way you expect.
Frequently Asked Questions
Is the generated HTML safe to render?
Yes. The input is HTML-escaped before tags are processed and javascript: URLs are rewritten, so script injection through the input is prevented. The escaping is why literal angle brackets appear as text.
Which tags are supported?
b, i, u, s, code, quote, center, size, color, url (both forms), img, list, list=1, and the [*] item marker. Anything else passes through as visible text.
Why is my [color] tag shown as plain text?
The color value must be a hex code or a simple word - values with quotes or unusual characters do not match the pattern and are left unconverted rather than turned into untrusted inline styles.
Does it handle nested tags?
Straightforward nesting such as [b]bold [i]and italic[/i][/b] converts correctly. The converter uses ordered replacements rather than a full parser, so pathological interleavings of the same tag can mis-nest - test anything complex.