Notepad Tab

Original Article ↗ Hacker News Discussion ↗

A tiny web app that turns a browser tab into a notepad by storing text in the URL fragment is drawing both praise for its simplicity and criticism for practical and privacy issues. Commenters highlight clever techniques like compression and base64 encoding, but point out URL length limits, browser history pollution, and reliance on Cloudflare’s injected scripts that undermine the site’s “no analytics, privacy-respecting” claims. Many compare it to local text editors, browser extensions, PWAs, and single-file tools like TiddlyWiki, debating whether such browser-based scratchpads are genuinely useful or just a novel but inferior reinvention of long-solved problems.

How it works

  • App stores note contents in the URL fragment using compressed + base64-encoded text.
  • Every keystroke updates the URL (often via location.hash), so the note is “saved” in the address bar and shareable by copying the URL.
  • Some experiments show similar behavior can be implemented as a single HTML file, a data URL, or a bookmarklet.

Privacy, Cloudflare, and “no analytics” claims

  • Site claims no analytics and thus strong privacy.
  • Commenters note Cloudflare’s injected beacon/RUM script is present; it’s described as part of Cloudflare’s anti‑DDoS / reputation system, not ad analytics.
  • However, the RUM payload includes the full page URL, which in this app means the entire note content is sent to Cloudflare, contradicting the “local-only”/privacy narrative.
  • It’s unclear whether Cloudflare sells this data, but users cannot fully opt out while using its protection.

History pollution and UX

  • Updating the hash on each keystroke spams browser history for many users (back button “untype” behavior).
  • One browser reportedly avoids this; others (Firefox, Safari, Chrome) do not.
  • Some see this as “infinite undo,” but most consider it annoying and suggest replaceState or batching updates.

Scaling limits and reliability

  • URL length limits mean only relatively short notes are safe; large pasted text can silently truncate and reload as “undefined.”
  • Compression (e.g., via pako) helps, but URLs still grow and eventually hit practical limits; noted as a fundamental constraint of the design.

Security concerns

  • URL fragments normally aren’t sent in HTTP requests, which would protect note content.
  • But Cloudflare’s injected analytics call includes the full URL (including fragment) in its JSON payload, so notes are visible to Cloudflare.

Alternatives and use cases

  • Many argue a basic local text editor or OS notes app solves this better: autosave, no URL limits, no history spam.
  • Others like the browser-based scratchpad because the browser is always open, new tabs are low-friction, and notes can live in the same tab group/context.
  • Numerous similar tools are shared (simple HTML pads, extensions, local-storage notes, TiddlyWiki, etc.), plus ideas for local “mini web app” servers or PWAs to avoid third-party hosting entirely.