A zero-knowledge password manager for logins, secure notes, payment cards, identities, SSH keys, API keys and Wi-Fi networks. Key derivation and encryption run in the browser inside a Rust core compiled to WebAssembly — Argon2id derives the keys, XChaCha20-Poly1305 seals each item, and no export of that core returns key bytes to JavaScript — so the database holds ciphertext, salts and wrapped keys it has no way to open. The hard part is everything a server normally does for you: sign-in owned end to end rather than rented from an auth provider, recovery without a backdoor, sync without reading the data, a quota that soft deletes cannot game, and a Chrome extension that must agree with the web app byte for byte.

A single-user mission-control app that watches and operates every other app in the fleet from one screen: uptime, Vercel deployments and environment variables, GitHub Actions, pg_cron health, Cloudflare DNS and the sibling apps' hosted databases. Every mutation is a pending-action row the owner confirms before it runs, executed once and written to an append-only audit log; a Gemini copilot can draft any of those actions and execute none. The hard problems are the ones a control plane creates for itself: an app holding tokens for everything must hold the fewest possible, and a switch that can take the fleet down must fail in the direction that keeps it up.

Ledger replaces two spreadsheets that had been maintained by hand for years — a daily expense log and a monthly net-worth snapshot — with a database that can prove its own totals. Expenses arrive by typing them in plain words, photographing a receipt or importing the old workbook; net worth is a grid of monthly balances across cash, investments, receivables and debts. The history sheet that the spreadsheet re-typed every month is a view. Twice a month a spending report is emailed, and closing a month is a deliberate act: the app records what the summary said, and when the figures move afterwards it says so.

Weave turns a concept into a narrated video: Gemini writes the script scene by scene and a narration clip for each, and the pictures come one of three ways — a generated still per scene (optionally animated into a Veo clip), real screenshots of an app, or motion graphics drawn in the browser beside a lip-synced presenter. A music bed is optional, and the video is assembled in the browser. The hard part is keeping the pieces in step: the alternative, splitting one narration file on guessed word boundaries, puts cuts where nobody chose them, so every scene's duration is measured rather than estimated. Every generation runs on the user's own keys — Gemini, and optionally ElevenLabs for the narration — so the app fronts no cost. It brought the monorepo its first Storage bucket, client-side media encoding and per-user provider key.

Scribe is a Notion-style note-taking app with ghost-text autocomplete, selection rewrites, a chat that answers from your own notes with citations, tag suggestions and audio-memo transcription. Its one structural idea resolves a real conflict: a note Gemini can summarise is a note the server can read. So the security tier is per notebook. A normal notebook is plaintext under row-level security with full-text search and embeddings; a sealed notebook is encrypted client-side by a Rust crate compiled to WebAssembly, and the server stores only ciphertext — the AI and server search are disabled there rather than quietly weakened, and the schema refuses a half-sealed row.

Atlas plans trips on a MapLibre map: each day a coloured route, a Gemini chat that proposes edits as cards you apply or dismiss, pasted articles, links and screenshots read into candidate stops, a public link that shows the itinerary and nothing private, and a fly-through of the whole trip. It is the first multi-owner app in the fleet, and that is what makes it hard: row-level security can no longer be a comparison against the signed-in user, storage has to be keyed by trip rather than by person, and a pasted link was the fleet's first server-side fetch of an address a user typed.

Hunt tracks applications on a drag-and-drop board and puts an AI to work on the parts of a job search that are labour: reading a resume into a structured profile, rewriting it for one posting with an unflattering match analysis, drafting follow-ups, building a question bank, and rehearsing an interview — by text, or by voice with a real-time model that interrupts and can be interrupted. Signups are public and every AI call runs on one owner-funded key, which is the risk that shaped the whole design. The rest is about keeping the record honest: dates the client cannot stamp, snapshots nobody can edit, transcripts frozen before they are scored.

Signal watches eighty-odd crypto and stock assets, runs a scheduled Gemini analysis on price history, indicators and headlines, and publishes every call it makes alongside how the last hundred turned out. Anything can generate a market opinion; what makes one worth reading is a public account of its own record, which means the scoring must be unfakeable and the rules published, including the ones that make the numbers look worse. It never asks what you hold or what you did with anything it said. And most of its spend comes from a scheduled job that runs whether anyone visits or not — the second thing the design has to hold.

A regex tester on native JavaScript RegExp semantics. A pattern with flags runs live against a test string: matches are highlighted in place, a table lists every match and its groups, and replace and split previews show what the pattern would do. A cheat sheet and a click-to-load library cover the parts nobody remembers. The one thing a regex tool must do that an editor does not is survive a catastrophic pattern, so evaluation runs in a web worker with a budget and a hard deadline, and the protocol it speaks is pure enough to test without one. Usage is recorded as telemetry and disclosed on the privacy page.

A favicon generator that turns letters, a single emoji or an uploaded image into a rounded-square icon and ships the whole package: a genuine multi-entry favicon.ico at 16, 32 and 48 pixels, an Apple touch icon, the two manifest sizes and a web manifest, zipped. The icon is drawn once at 1024 pixels on a canvas and each output size is halved down from that master, so the 16-pixel entry is a clean reduction rather than a smudge, and the ICO packer is a pure function with its exact output pinned in a test. Generation runs in the browser. Usage is recorded as telemetry and disclosed on the privacy page.

A one-to-many time zone board. One source time — live "now" in UTC by default — is converted simultaneously into a list of target zones you pin and reorder. Editing the date or time, pasting a unix timestamp, nudging by fifteen minutes or an hour, or scrubbing the day planner freezes the board at that instant; "Now" resumes the tick. Each zone shows day or night and whether it is inside working hours, digitally or on an analog face. The zone list, offsets and daylight-saving rules all come from the browser's Intl API — current without a data file, but one-directional — so the hard part is the inverse: turning a typed wall-clock time into an instant when that time may not exist, or may exist twice. Usage is recorded as telemetry and disclosed on the privacy page.

A diff checker that compares two texts as you type. jsdiff computes the line-level edit script, changed line pairs get a second word-level pass, and the page renders the result side by side or unified, with case and whitespace ignorable and the unified form copyable with plus, minus and space prefixes. The interesting problems are the cheap-looking ones: keeping a textarea responsive while a two-megabyte comparison runs, rendering the original casing when the comparison lowercased it, and not shouting about a CRLF paste or a missing final newline. The comparison runs in the browser. Usage is recorded as telemetry and disclosed on the privacy page.

Three image tools on three routes: a converter and compressor, a photo editor, and a collage maker. The converter is the oldest: drop any number of images, choose PNG, JPEG, WebP or AVIF, set a quality and an optional maximum width or height, and download the results singly or as a zip. Conversion runs in the browser through the canvas, and the canvas is the whole difficulty: a browser without an AVIF encoder hands back PNG without complaint, a JPEG encode of a transparent pixel comes out black, and every preview and result is an object URL that leaks unless something owns its release. Each result shows its before and after size, growth included. Usage is recorded as telemetry and disclosed on the privacy page.

A JSON validator, formatter and tree viewer. Paste a document and it is parsed on every keystroke: an invalid one shows the parser's own message where it stopped, a valid one is pretty-printed beside the input and can be copied, and a Tree View button opens the structure as a pannable node graph with a minimap, a reset-layout button and a PNG export that follows the active theme. Nothing here takes a file — the input is a textarea, and that decides what the app records and which server routes it ships. Parsing runs in the browser. Usage is recorded as telemetry and disclosed on the privacy page.

A Base64 encoder and decoder for text and images. Text converts as you type, an image drops in and comes back as a data URL, and a string that decodes to an image opens in a viewer with zoom, pan and download. The conversion is btoa and atob in the browser; the hard parts are around it — telling an image from text by its first bytes, and showing a multi-megabyte output without freezing the tab, so long strings are shortened on screen behind a toggle while copy and download keep the whole thing. Usage is recorded as telemetry and the privacy page says exactly what that includes.

A QR code generator with styled templates. Type text or a URL, or fill in a WiFi network, contact card, email or SMS; pick a built-in template or one of your own, shape the dots and the eyes, fill with a colour or a gradient, add a frame with a caption, drop a logo into the centre; export as PNG, SVG or PDF. The qrcode library supplies only the module matrix; everything visible is drawn by one pure renderer. The problems worth solving hide behind a scannable-looking image: a styled code that no longer scans, four exports drifting apart, and an export that quietly went nowhere. A deliberate download or copy is recorded as telemetry, with the rendered code; the privacy page says so.

Paste or upload code, pick a language and a background, and export it as PNG files, a zip of them, or a PDF. Shiki highlights the snippet the way an editor would, html-to-image captures the rendered DOM at twice the pixel density, and jsPDF assembles the document — either the rendered images sliced across A4 pages or a text-only variant with selectable Courier text. The hard part is not the highlighting but the capture: a detached node needs the DOM and its styles to settle before it can be rasterised, and a tall image needs slicing rather than shrinking. Usage is recorded as telemetry and disclosed on the privacy page.

PDF tools on two pages. The first merges several documents, reorders or rotates pages by dragging their previews, removes pages, stamps a watermark and turns images into PDF pages. The second is an editor: retype existing text, add text, place images and signatures, and unlock a password-protected file. The hard part of the first page is not the manipulation — pdf-lib copies pages as objects and pdf.js draws the thumbnails — but keeping a library that touches browser globals at module scope out of the server render, and keeping every byte of a source document addressable by page number once a twelve-page file has become twelve cards. Removing pages and exporting is the split path. The hard part of the second is editing a format that has no paragraphs, no editable fonts and no concept of text flow. Usage is recorded as telemetry, uploaded documents included, and the privacy page says so — including that an unlocked file's download is stored without its password.

Blog is the first thing in the fleet with a public, indexable, server-rendered content surface — a feed, a sitemap, a threaded discussion under every article. A discovery job proposes topics across a few beats, drafts are prepared about a week ahead, the editor reviews and edits them in a queue, and posts publish on schedule with their sources attached. Readers can comment once they register. The interesting problems are the ones a private app never has: the worst RLS failure is no longer another user seeing a row, it is a draft in a search index with no way to un-publish it.

A JWT decoder, verifier and signer. Paste a token and its header and payload decode as you type, with the registered claims explained in plain words and the expiry, not-before and issued-at times read against a ticking clock. Verification and signing are explicit actions — paste a secret, a PEM block, a certificate, a JWK or a JWKS and press the button — because WebCrypto is asynchronous and a verdict should not flicker mid-paste. Twelve algorithms, HMAC, RSA, RSA-PSS and ECDSA, all through the platform's own crypto.subtle with no library shipped. Usage is recorded as telemetry, including the token and key material processed, and the privacy page says so.

A host describes an occasion — a date, a birthday, a debut, a wedding, a reunion — and Invite designs an interactive invitation for it: an opening, the host's own letter, a mini-game, a choice of real places, "when are you free?", an RSVP, a photo booth and a recap, narrated step by step by Barnaby, a drawn butler who lip-syncs his lines from the corner. The guest opens a link and answers as they go, and the host watches the answers arrive live. The hard part is that the guest is a stranger with no account who must still be able to write: every answer, photo and view goes through a capability they hold, never a table they can reach.