john.engineering

The URL is
the interface.

One domain, seventy-odd verbs. Type a path, get a result — YouTube, source code, references, and a set of tools that never touch a network.

See every command Open JMarchive
No tracking, no cookies, no analytics No build step Zero dependencies

Try it here first.

Type a route — or plain words like youtube search lofi beats. Press / anywhere on the page to jump into the field.

john.engineering return

Hyphens become spaces. Double hyphens stay hyphens.

Overview

Six families of verb.

Every route is a pure function from a path to a destination. Nothing is stored, nothing is logged, nothing phones home.

—Routes
—Families
—Offline tools
0Trackers

YouTube

Search, channels, playlists, Shorts, Music, live-only filters, timestamped links, and studio shortcuts.

  • /youtube/search/:query
  • /youtube/channel/:handle
  • /youtube/watch/:id/:seconds
  • /youtube/music/:query

Code

GitHub users, repos, pull requests and issues by number. Package registries, MDN, RFCs, CVEs, status codes.

  • /gh/:owner/:repo
  • /pr/:owner/:repo/:number
  • /npm/:package
  • /rfc/:number

Search

Google, DuckDuckGo, Wikipedia, Scholar, arXiv, Hacker News, Reddit, maps, directions, translation, weather.

  • /wiki/:query
  • /dir/:from/:to
  • /translate/:lang/:text
  • /weather/:place

Media

Spotify, IMDb, Letterboxd, podcasts, the App Store, plus profile and mail shortcuts.

  • /spotify/:query
  • /imdb/:query
  • /x/:handle
  • /mail/:address

Tools

Hashes, UUIDs, Base64, epoch time, colour maths, case conversion, dice, timers. Computed in your tab — no request is made.

  • /tools/hash/sha256/:text
  • /tools/password/:length
  • /tools/color/:value
  • /tools/timer/:duration

JMarchive

A private archive that the server itself cannot read. The passphrase never leaves the browser, and neither does the key it derives.

  • /JMarchive
  • /vault

/JMarchive

An archive with nothing to leak.

The contents ship as a single AES-256-GCM ciphertext. Your passphrase derives the key in the browser, decrypts in memory, and is discarded on lock. There is no login, no session, no server-side copy of anything readable.

  • CipherAES-256-GCM, authenticated
  • Key derivationPBKDF2-HMAC-SHA-256, 600,000 iterations
  • Salt / IV128-bit / 96-bit, random per pack
  • Key lifetimeMemory only — never stored, wiped on lock
  • Idle auto-lock5 minutes
  • What the host seesOne opaque blob
  • Metadata exposureNone — filenames are inside the ciphertext
  • IntegrityGCM tag, plus SHA-256 per entry
Open the archive

Honest threat model: because there is no server to rate-limit guesses, anyone who downloads the blob can attack it offline for as long as they like. Its security is exactly the entropy of your passphrase — so use a long one. Put Cloudflare Access or HTTP auth in front for a second layer.

Offline tools

Answers without a round trip.

These routes compute in the page. No API, no key, no request — check the network tab if you like.

Hash

SHA-1 through SHA-512 via WebCrypto.

/tools/hash/sha256/…

Password

CSPRNG passwords and passphrases with an entropy count.

/tools/password/32

UUID

Version 4 identifiers, in bulk.

/tools/uuid/5

Epoch

Unix time in both directions, with relative phrasing.

/tools/epoch/now

Colour

Hex, RGB, HSL, luminance and WCAG contrast.

/tools/color/0071e3

Base64

Encode or decode, UTF-8 safe.

/tools/base64/encode/…

JSON

Format, minify, and validate with real error messages.

/tools/json

Timer

A countdown that lives in the URL.

/tools/timer/25m

Reference

Every command.

Coloured segments are yours to fill in. :name takes one segment, *name takes the rest of the path.

Filter

Colophon

How it's built.

Static, all the way down

Hand-written HTML, one stylesheet, three scripts. No framework, no bundler, no dependencies, no build step. The whole site is a few dozen kilobytes and deploys by copying a folder.

Routing without a server

Unmatched paths fall through to 404.html, which parses the path against a route table and resolves it client-side. Works identically on Netlify, Vercel, Cloudflare Pages and GitHub Pages.

Privacy by omission

There is nothing to opt out of. No analytics, no cookies, no fonts fetched from a third party, no external requests at all until a route deliberately sends you somewhere.

Type and colour

San Francisco where it exists, Helvetica Neue where it doesn't. One accent colour, tight tracking on headlines, a 980-pixel column, and a full dark mode that follows the system.