Everything Kagoj does.

GitHub-flavoured, rendered to a real page.

Tables, task lists, strikethrough and autolinks all work. The output is sanitised at write time and stored, so reading a page never runs a sanitiser and never trusts what is in the database.

A formatting toolbar, for when you would rather not write Markdown.

Bold, italic, strikethrough, inline code, three heading levels, both kinds of list, quotes, code blocks and links. It emits ordinary HTML, which goes through exactly the same sanitiser as a pasted HTML file.

Link addresses are checked as you type them, against the same protocols the sanitiser allows, so you find out immediately rather than discovering a stripped link after publishing.

Upload a whole .html file and it keeps its own styling.

Scripts, event handlers, forms and frames are removed. The author's stylesheet survives, because an HTML document without its CSS is not the document you uploaded.

It is then served from a separate usercontent path inside a sandboxed frame with a locked content security policy, so even a sanitiser bug cannot reach your session.

Syntax highlighting with automatic language detection.

Drop a .c, .py, .ts, .json or any other source file and the language is inferred from the extension; you can also set it by hand. Highlighting is done at write time with class names only, so it survives the same sanitiser as everything else.

Renders in the page, including inside the installed app.

PDFs are drawn to a canvas rather than handed to the browser's plugin, because that plugin does not exist in an installed web app or on most phones. That is the difference between a document and a message saying your browser cannot display it.

Screenshots and photographs, up to 50 MB.

PNG, JPEG, GIF, WebP, AVIF, BMP, TIFF, ICO, HEIC and SVG.

SVG is an image that can contain script, so it renders inside an image tag where scripting is off, downloads are forced as an attachment, and it is never offered as an open-in-new-tab link.

Plays in the page, up to 100 MB.

MP4, WebM, Ogg, QuickTime and M4V, which is what a browser can play without a plugin.

It loads metadata only until you press play, so opening a link to see what it is does not pull down a hundred megabytes, and nothing ever autoplays.

Exactly as typed, escaped, never interpreted.

Angle brackets stay angle brackets. Useful for logs, config and anything you want quoted rather than rendered.

Every document gets a ten-character link the moment it exists.

The link is copied to your clipboard when you publish, because copying the link is the entire point and making you select it by hand was the worst thing about the first version.

Listed, indexable, readable by anyone.

Search engines and AI crawlers may index it. Nothing else is indexable.

The unguessable URL is the grant.

Anyone holding the link can read it; nothing links to it and it is never indexed. This is the default for anything you publish.

Everyone in the team that owns it.

Membership is the permission, so people joining and leaving does not mean revisiting each document.

Named people, by email address.

Someone who is not signed in gets a sign-in wall rather than a 404, so they can tell the difference between the wrong link and a link that is not for them yet.

There is no email round trip: you paste them the link, they sign in, they are in. Grants add up rather than replacing one another, and revoking one takes effect on the next request.

Reading and editing are separate grants.

Someone can hold VIEW or EDIT. Editing is never implied by reading, and access granted through a project is inherited by the documents in it.

Set a moment after which the link stops opening.

The document is not deleted, only closed. You can still open it yourself and lift the expiry whenever you like. Named people and team members are unaffected, because the expiry is on the link, not on them.

Burns after the first person opens it.

The next visitor is turned away. You can still open it yourself, and saving the control again re-arms it, so it is a door you can reset rather than a fuse you can only blow once.

A word a link-holder must type before the page opens.

Stored as a salted hash, never in the clear. Enter it once and you are not asked again for twelve hours; changing the passphrase invalidates that immediately. Owners, named people and team members are never challenged, because they were let in as people, not as a link.

Everything you own, newest first, with full-text search over the text inside.

Search is a real Postgres full-text query. It understands quoted phrases, OR and -exclusion, ranks a title match above a body match, and matches word stems rather than raw substrings. It is scoped twice: the query narrows to rows you could plausibly reach, then every row that comes back is re-checked against the same access rules the rest of the app uses.

Select several documents at once to file them under a project or send them to the trash together, and each one carries a quiet count of how many times it has been opened.

Deleting is recoverable for thirty days.

Deleting a document moves it to the trash rather than destroying it. It keeps its storage there, so restoring is lossless, and after thirty days the same sweep that clears anonymous content purges it for good. You can also delete it outright from the trash if you would rather not wait.

Copy any text document you can read into one of your own.

The copy is yours, on its own link, ready to edit. Useful for templates, and for building on someone else's public page without touching theirs. Text kinds only, since a file's bytes are not duplicated.

A bundle of documents that shares its access.

Set a project to team-visible and everything filed in it follows, so you set the rule once instead of per document. Documents can be moved between projects from the shelf.

Anyone can make one and invite anyone.

There is no domain claim and no administrator to petition. Members are owners, editors or readers, and a team carries its own storage allowance.

Every save keeps what was there before, and you can put it back.

Open a text, Markdown, rich text, code or HTML document you can edit, and the history sits under the editor. Each entry is the document as it was before that save.

Restoring is itself recorded as a save, so restoring the wrong version is not a one-way door.

A PDF, image or video is replaced rather than versioned: upload a new file from its page and the same short link points at it, with the old file removed once the new one lands.

Four scopes, granted one at a time.

READ, WRITE, SHARE and DELETE. SHARE is deliberately not implied by WRITE: changing who can see a document is the dangerous action, so an agent that can write cannot publish to the open web unless you said so separately. DELETE moves a document to the trash, so even an agent's mistake is recoverable for thirty days.

List, read, create, edit, re-share and delete over HTTP.

Each scope maps to something the key can actually do: READ fetches a document and its body, WRITE creates and edits text, SHARE changes visibility, DELETE trashes. A single bearer token, no SDK and no OAuth dance.

No second, weaker code path.

The API answers to exactly the same access rules as the pages do. A key cannot reach anything you could not reach yourself.

Every agent action is attributable to a key.

What it did, to what, and which key it used. You can read it and you can revoke the key.

Paste something and get a link, immediately.

Anonymous documents delete themselves after 24 hours. If you decide you want to keep one, signing in claims it: the same link, now yours, with no expiry.

It works as an app on a phone or desktop.

Installed, it gets a tab bar instead of a menu and holds exactly one viewport, so the bar never scrolls away. There is an offline page rather than a browser error.

Both themes, following your system by default.

The document sheet itself changes with the theme, so reading at night does not mean staring into a bright rectangle in a dark app.

⌘K to jump anywhere, or search your shelf.

One shortcut, from any page, to reach your shelf, a project, the trash or your settings, or to run the same shelf search without leaving what you are doing.

Drop a public page into another site with an iframe.

Public documents come with a copy-ready embed snippet that renders the page with no Kagoj chrome around it. Only public documents can be embedded, and the embed runs with scripts switched off.

Export everything, or delete the account entirely.

Download your account and every document you own as one JSON file. Deleting your account purges every document you own, including their files, and asks you to type your email first so a stray click cannot do it. Teams you created are left standing for their other members.