A toolbox that does one thing, in one language

• One front controller, a small router, controllers that return a Response.
• Views are plain PHP templates with a single layout; no template engine, no build step.
• SQLite with WAL for everything that is stored. One file, one sqlite3 backup.
• Vanilla JavaScript, three files, no framework: theme, copy-to-clipboard, command palette.
• CSS written by hand in one file, with the same palette as the main site.

Nothing you paste into a tool is stored: one request, one response, done. The only things kept are your own workspace records and, if you write through the contact form, the message. IP addresses are truncated before being written. Two strictly necessary cookies, no analytics. Full privacy notice · cookies

QR codes: versions 1-6, level M

Enough for URLs, WiFi credentials and short text (about 106 bytes). Longer content is refused with a clear message instead of producing a code that nobody can scan. The encoder is written from the specification and its output has been verified against an independent decoder, module by module.

Regex: no way to interrupt a match

PCRE can backtrack exponentially, and PHP offers no timeout inside preg_match. The subject is therefore capped and patterns longer than 1000 characters are refused; a pattern that looks catastrophic is flagged in the interface.

HTTP inspector: public addresses only

Requests to private, loopback, link-local and reserved addresses are refused, and redirects are re-checked at every hop, so the server cannot be used to read a router or a cloud metadata endpoint. Responses are never cached, and the tool is rate limited.

Markdown is a subset

Headings, lists, tables, code, quotes, links, emphasis: what people actually use. Raw HTML is escaped before anything else happens, so it is never interpreted. No footnotes, no raw HTML, no plugins — on purpose.