diff --git a/source/Ox/js/HTML.js b/source/Ox/js/HTML.js
index bf742c66..a4974b57 100644
--- a/source/Ox/js/HTML.js
+++ b/source/Ox/js/HTML.js
@@ -27,8 +27,12 @@
         },
         replace = {
             mail: [
-                /\b([0-9A-Z\.\+\-_]+@(?:[0-9A-Z\-]+\.)+[A-Z]{2,6})\b/gi,
-                '<a href="mailto:$1">$1</a>'
+                /\b([0-9A-Z\.\+\-_]+@(?:[0-9A-Z\-]+\.)+[A-Z]{2,6})\b/gi, '$1'
+                /*
+                function(match, mail) {
+                    return Ox.encodeEmailAddress(mail);
+                }
+                */
             ],
             namedEntity: [
                 new RegExp('(' + Ox.values(htmlEntities).join('|') + ')', 'g'),
@@ -84,7 +88,7 @@
             },
             url: [
                 /\b((https?:\/\/|www\.).+?)([\.,:;!\?\)\]]*?(\s|$))/gi,
-                function(string, url, prefix, end) {
+                function(match, url, prefix, end) {
                     prefix = prefix.toLowerCase() == 'www.' ? 'http://' : '';
                     return Ox.formatString(
                         '<a href="{prefix}{url}">{url}</a>{end}',
@@ -152,6 +156,24 @@
             : Ox.normalizeHTML(replaceString(string));
     };
 
+    /*@
+    Ox.encodeEmailAddress <f> Returns obfuscated mailto: link
+        > Ox.encodeEmailAddress('mailto:foo@bar.com').indexOf(':') > -1
+        true
+    @*/
+    Ox.encodeEmailAddress = function(string) {
+        var parts = ['mailto:' + string, string].map(function(part) {
+            return Ox.map(part, function(char) {
+                var code = char.charCodeAt(0);
+                return char == ':' ? ':'
+                    : '&#'
+                    + (Math.random() < 0.5 ? code : 'x' + code.toString(16))
+                    + ';'
+            });
+        });
+        return '<a href="' + parts[0] + '">' + parts[1] + '</a>';
+    };
+
     /*@
     Ox.encodeHTMLEntities <f> Encodes HTML entities
         (string[, encodeAll]) -> <s> String
@@ -329,12 +351,62 @@
         return Ox.$('<div>').html(html).html();
     };
 
+    /*@
+    Ox.parseMarkdown <f> Parses (a tiny subset of) Markdown.
+        \*foo\* -> <em>foo</em>
+        \*\*foo\*\* -> <strong>foo</strong>
+        \`foo\` -> <code>foo</code>
+        \`\`\`code\`\`\` -> <pre><code>foo</pre></code>
+        [example](http://example.com "example.com") -> <a href="http://example.com" title="example.com">example</a>
+        > Ox.parseMarkdown('*foo* **bar** `baz` ``back`tick``')
+        '<em>foo</em> <strong>bar</strong> <code>baz</code> <code>back`tick</code>'
+        > Ox.parseMarkdown('[example](http://example.com "example.com")')
+        '<a href="http://example.com" title="example.com">example</a>'
+        > Ox.parseMarkdown('[example](http://example.com?foo=bar&bar=baz)')
+        '<a href="http://example.com?foo=bar&amp;bar=baz">example</a>'
+    */
+    Ox.parseMarkdown = function(string) {
+        // see https://github.com/coreyti/showdown/blob/master/src/showdown.js
+        return string.replace(/\r\n/g, '\n').replace(/\r/g, '\n')
+            .replace(/\n\n/g, '<br><br>')
+            .replace(
+                /(\*\*|__)(?=\S)([^\r]*?\S[*_]*)\1/g,
+                '<strong>$2</strong>'
+            )
+            .replace(
+                /(\*|_)(?=\S)([^\r]*?\S)\1/g,
+                '<em>$2</em>'
+            )
+            .replace(
+                /\n```(.*)\n([^`]+)\n```/g,
+                function(match, a, b) {
+                    return '<pre><code class="'+ a + '">'
+                        + Ox.encodeHTMLEntities(b) + '\n</code></pre>';
+                }
+            )
+            .replace(
+                /(^|[^\\])(`+)([^\r]*?[^`])\2(?!`)/gm,
+                function(match, a, b, c, d) {
+                    return a + '<code>'
+                        + Ox.encodeHTMLEntities(c.trim()) + '</code>';
+            	}
+            )
+            .replace(
+                /(\[((?:\[[^\]]*\]|[^\[\]])*)\]\([ \t]*()<?(.*?)>?[ \t]*((['"])(.*?)\6[ \t]*)?\))/g,
+                function(match, a, b, c, d, e, f, g) {
+                    return '<a href="' + Ox.encodeHTMLEntities(d) + '"' + (
+                        g ? ' title="' + Ox.encodeHTMLEntities(g) + '"' : ''
+                    ) + '>' + b + '</a>';
+                }
+            );
+    };
+
     /*@
     Ox.sanitizeHTML <f> Takes untrusted HTML and returns something trustworthy
-        > Ox.sanitizeHTML('http://foo.com, bar')
-        '<a href="http://foo.com">http://foo.com</a>, bar'
-        > Ox.sanitizeHTML('http://foo.com/foo?bar, bar')
-        '<a href="http://foo.com/foo?bar">http://foo.com/foo?bar</a>, bar'
+        > Ox.sanitizeHTML('http://foo.com, ...')
+        '<a href="http://foo.com">http://foo.com</a>, ...'
+        > Ox.sanitizeHTML('http://foo.com/foo?bar&baz, ...')
+        '<a href="http://foo.com/foo?bar&amp;baz">http://foo.com/foo?bar&amp;baz</a>, ...'
         > Ox.sanitizeHTML('(see: www.foo.com)')
         '(see: <a href="http://www.foo.com">www.foo.com</a>)'
         > Ox.sanitizeHTML('foo@bar.com')