Everything Kagoj does.

GitHub-flavoured, rendered to a real page.

Tables, task lists, strikethrough and autolinks all work. The output is sanitised at write time and stored, so reading a page never runs a sanitiser and never trusts what is in the database.

A formatting toolbar, for when you would rather not write Markdown.

Bold, italic, strikethrough, inline code, three heading levels, both kinds of list, quotes, code blocks and links. It emits ordinary HTML, which goes through exactly the same sanitiser as a pasted HTML file.

Link addresses are checked as you type them, against the same protocols the sanitiser allows, so you find out immediately rather than discovering a stripped link after publishing.

Upload a whole .html file and it keeps its own styling.

Scripts, event handlers, forms and frames are removed. The author's stylesheet survives, because an HTML document without its CSS is not the document you uploaded.

It is then served from a separate usercontent path inside a sandboxed frame with a locked content security policy, so even a sanitiser bug cannot reach your session.

Syntax highlighting with automatic language detection.

Drop a .c, .py, .ts, .json or any other source file and the language is inferred from the extension; you can also set it by hand. Highlighting is done at write time with class names only, so it survives the same sanitiser as everything else.

Renders in the page, including inside the installed app.

PDFs are drawn to a canvas rather than handed to the browser's plugin, because that plugin does not exist in an installed web app or on most phones. That is the difference between a document and a message saying your browser cannot display it.

Screenshots and photographs, up to 50 MB.

PNG, JPEG, GIF, WebP, AVIF, BMP, TIFF, ICO, HEIC and SVG.

SVG is an image that can contain script, so it renders inside an image tag where scripting is off, downloads are forced as an attachment, and it is never offered as an open-in-new-tab link.

Plays in the page, up to 100 MB.

MP4, WebM, Ogg, QuickTime and M4V, which is what a browser can play without a plugin.

It loads metadata only until you press play, so opening a link to see what it is does not pull down a hundred megabytes, and nothing ever autoplays.

Exactly as typed, escaped, never interpreted.

Angle brackets stay angle brackets. Useful for logs, config and anything you want quoted rather than rendered.

CSV as a table you can sort and filter, not a wall of commas.

The delimiter is worked out from the file, so comma, tab, semicolon and pipe files all open. Quoted fields keep their commas, their line breaks and their escaped quotes, which is what separates this from splitting on a comma and hoping.

Columns of numbers are recognised and sort as numbers, so 1,200 lands after 980 rather than before it. Money and percentages count too.

The file itself is what is stored and what downloads, untouched. The table is only how it is shown.

Every document gets a ten-character link the moment it exists.

The link is copied to your clipboard when you publish, because copying the link is the entire point and making you select it by hand was the worst thing about the first version.

Paste a link instead of content and Kagoj just shortens it.

You get kagoj.app/AbC123: six characters, served bare at the top level, and it never expires even if you made it without an account.

Signed in, you can choose the code instead: kagoj.app/spring-sale. Three to 32 characters, letters, numbers and hyphens.

A shortened link is a Kagoj document like any other, so an expiry, a one-time burn or a passphrase all work on it, and the clicks are counted for you.

Put /s/ before the code and Kagoj shows you exactly where a link goes before you follow it, including when the domain is spelled with lookalike characters.

Destinations are checked against Google Safe Browsing when they are set and whenever they change, so a link cannot be quietly repointed at malware later.

Listed, indexable, readable by anyone.

Search engines and AI crawlers may index it. Nothing else is indexable.

The unguessable URL is the grant.

Anyone holding the link can read it; nothing links to it and it is never indexed. This is the default for anything you publish.

Everyone in the team that owns it.

Membership is the permission, so people joining and leaving does not mean revisiting each document.

Named people, by email address.

Someone who is not signed in gets a sign-in wall rather than a 404, so they can tell the difference between the wrong link and a link that is not for them yet.

There is no email round trip: you paste them the link, they sign in, they are in. Grants add up rather than replacing one another, and revoking one takes effect on the next request.

Reading and editing are separate grants.

Someone can hold VIEW or EDIT. Editing is never implied by reading, and access granted through a project is inherited by the documents in it.

A time it goes live, a time it stops, or both.

Write the announcement on Sunday night and set it to open at nine on Monday. Before then the link is closed to everyone but you, and it tells a reader it opens later rather than pretending not to exist.

The document is never deleted, only closed. You can open it yourself throughout and move either end whenever you like. Named people and team members are unaffected, because the window is on the link, not on them.

Close the link after this many people have opened it.

Set it to one and you have the classic burn-after-reading link. Set it to five and the five people you sent it to can each open it once.

Your own visits never count, so checking it does not spend it. Changing the number starts the count again, which is how a spent link is re-armed rather than replaced.

A word a link-holder must type before the page opens.

Stored as a salted hash, never in the clear. Enter it once and you are not asked again for twelve hours; changing the passphrase invalidates that immediately. Owners, named people and team members are never challenged, because they were let in as people, not as a link.

Every page and every short link has one, ready to print.

Open the QR panel on any page and download it as an SVG, which stays sharp at poster size, or a PNG. There is also a plain image address, /s/CODE/qr, for dropping into a slide or an email.

Four levels of damage tolerance, so a code that will live on a sticker can survive a scuff or a logo over the middle.

A link that runs the other way, so somebody can send you a file.

Send it to a client or a contractor and they can upload without an account, without seeing anything else you have, and without being able to read back what they sent. It lands in your shelf, visible only to you.

You set the ceilings when you make it: how many files, how large each one may be, and when it stops accepting. You can close it at any time, and closing is reversible.

Every arriving file is charged to your storage and checked against it first, so a request can never be used to push you past your limit.

Everything you own, newest first, with full-text search over the text inside.

Search is a real Postgres full-text query. It understands quoted phrases, OR and -exclusion, ranks a title match above a body match, and matches word stems rather than raw substrings. It is scoped twice: the query narrows to rows you could plausibly reach, then every row that comes back is re-checked against the same access rules the rest of the app uses.

Select several documents at once to file them under a project or send them to the trash together, and each one carries a quiet count of how many times it has been opened.

Deleting is recoverable for thirty days.

Deleting a document moves it to the trash rather than destroying it. It keeps its storage there, so restoring is lossless, and after thirty days the same sweep that clears anonymous content purges it for good. You can also delete it outright from the trash if you would rather not wait.

Copy any text document you can read into one of your own.

The copy is yours, on its own link, ready to edit. Useful for templates, and for building on someone else's public page without touching theirs. Text kinds only, since a file's bytes are not duplicated.

A bundle of documents that shares its access.

Set a project to team-visible and everything filed in it follows, so you set the rule once instead of per document. Documents can be moved between projects from the shelf.

Anyone can make one and invite anyone.

There is no domain claim and no administrator to petition. Members are owners, editors or readers, and a team carries its own storage allowance.

Every save keeps what was there before, and you can put it back.

Open a text, Markdown, rich text, code or HTML document you can edit, and the history sits under the editor. Each entry is the document as it was before that save.

Restoring is itself recorded as a save, so restoring the wrong version is not a one-way door.

A PDF, image or video is replaced rather than versioned: upload a new file from its page and the same short link points at it, with the old file removed once the new one lands.

Four scopes, granted one at a time.

READ, WRITE, SHARE and DELETE. SHARE is deliberately not implied by WRITE: changing who can see a document is the dangerous action, so an agent that can write cannot publish to the open web unless you said so separately. DELETE moves a document to the trash, so even an agent's mistake is recoverable for thirty days.

List, read, create, edit, re-share and delete over HTTP.

Each scope maps to something the key can actually do: READ fetches a document and its body, WRITE creates and edits text, SHARE changes visibility, DELETE trashes. A single bearer token, no SDK and no OAuth dance.

No second, weaker code path.

The API answers to exactly the same access rules as the pages do. A key cannot reach anything you could not reach yourself.

Every agent action is attributable to a key.

What it did, to what, and which key it used. You can read it and you can revoke the key.

Words and characters as you type, then everything underneath them.

Sentences counted without splitting on 3.14 or on Dr. Lovelace, paragraphs, lines, reading time and speaking time.

A Flesch reading-ease score with its grade level, withheld until there is enough text for the number to mean anything. Below about twenty-five words it swings on every word you add, and a confident wrong number is worse than none.

Keyword density over single words and two and three word phrases, with the words every text contains filtered out by default. Phrases never run across a full stop.

The length is shown against the limits people actually hit: a page title, a meta description, an SMS, an X post. Counting characters is almost never curiosity, it is a box with a maximum.

Two versions of anything, with the changed words picked out.

Side by side or unified, with line numbers on both sides. Within a changed line only the words that actually differ are marked, which is the difference between seeing what changed and hunting for it.

Whitespace, case and blank lines can each be ignored. Copy the result as a unified diff for a ticket, or keep it as a Kagoj page.

It runs entirely in your browser. Neither side is uploaded, which matters because people paste config and contracts into diff tools.

Any link or text into a code, with nothing shortened and nothing kept.

The code holds exactly what you typed, so it points straight at your address instead of bouncing through Kagoj, and it will still scan long after any particular website has stopped existing.

Wi-Fi credentials, contact cards, phone numbers and email addresses all work, not just links.

What a photo gives away, and how to take it back.

Reads Exif, XMP, IPTC and PNG text out of JPEG, PNG, WebP and TIFF, then answers the question people actually came with: where this was taken, when, on what, and by whom. The location comes with a map pin and the coordinates in degrees, minutes and seconds.

It shows the preview image hiding inside the file. Editors routinely leave the old thumbnail behind after a crop, so that preview can still show what you cropped out.

Removal is byte surgery on the container, not a canvas round trip, so the compressed picture is copied across untouched and the photo is not quietly recompressed to strip it. The rotation tag is written back by default, because deleting it is why so many stripped photos end up sideways.

The file is read in your browser. Every other site that answers this question asks you to upload the photo first, which means handing over your address to find out whether your photo contains your address.

Paste something and get a link, immediately.

Anonymous documents delete themselves after 24 hours. If you decide you want to keep one, signing in claims it: the same link, now yours, with no expiry.

It works as an app on a phone or desktop.

Installed, it gets a tab bar instead of a menu and holds exactly one viewport, so the bar never scrolls away. There is an offline page rather than a browser error.

Both themes, following your system by default.

The document sheet itself changes with the theme, so reading at night does not mean staring into a bright rectangle in a dark app.

⌘K to jump anywhere, or search your shelf.

One shortcut, from any page, to reach your shelf, a project, the trash or your settings, or to run the same shelf search without leaving what you are doing.

Drop a public page into another site with an iframe.

Public documents come with a copy-ready embed snippet that renders the page with no Kagoj chrome around it. Only public documents can be embedded, and the embed runs with scripts switched off.

Export everything, or delete the account entirely.

Download your account and every document you own as one JSON file. Deleting your account purges every document you own, including their files, and asks you to type your email first so a stray click cannot do it. Teams you created are left standing for their other members.