cowyo.com

TLDR: Open cowyo.com, type on a blank page, and share its URL. The page saves automatically and can also be read or written as plain text with curl.

I first made cowyo in 2016 as a fast, self-contained place to jot down notes. Over time it became a small wiki, with Markdown rendering, history, lists, locks, encryption, and other modes. For version 3 I went back to the original idea: a pastebin for minimalists.

The new design has one main surface—a full-screen, monospaced text editor—and almost nothing between you and the text.

The interface disappears #

There is no toolbar across the screen. A small cow in the top-right corner is the only persistent control. It darkens as you type, then settles back one second after you stop. Selecting it opens a compact menu for copying the text, encrypting or decrypting it, publishing it, locking it, arming self destruct, changing the theme, or reading about the site.

The editor follows the device’s light or dark appearance by default, with a device-wide override if you prefer the other theme. Web addresses remain plain text but are still clickable. Password dialogs stay within the visible part of a phone screen when the keyboard opens.

When several people open the same URL, edits travel over a WebSocket and appear for everyone in real time.

Pages are just URLs #

Opening the home page creates a memorable alliterative path such as calm-cat. There are no accounts or document lists: the URL is the way back to the page and the way to share it.

The same page has a browser interface and a terminal interface. A browser gets the editor, while curl gets only the stored text:

curl https://cowyo.com/calm-cat
curl --data-binary @notes.txt https://cowyo.com/
curl --data-binary @notes.txt https://cowyo.com/calm-cat

Posting to the home page creates a randomly named page. Posting to a named path creates or replaces that page, which makes cowyo useful in small scripts as well as in a browser.

Separate controls for sharing and protection #

Version 3 keeps publishing, locking, and encryption deliberately separate because each solves a different problem.

Pages are unpublished by default. Publishing adds a page to the sitemap and allows search engines to discover it; unpublishing removes its text from search and link-preview metadata. An unpublished page is still readable by anyone who knows its URL.

A page lock prevents edits but does not hide the text. The server stores a password verifier rather than the password itself, and the page stays read-only until it is unlocked.

Encryption protects the text itself. It happens entirely in the browser using scrypt and XChaCha20-Poly1305, so the encryption password is never sent to cowyo. Encrypted sections are wrapped in versioned blocks, and decrypting them preserves any ordinary text around those blocks.

A page can also be armed to self destruct. Its next browser or curl request receives the text one final time and atomically deletes the page.

How it is built #

The server is written in Go and stores pages in SQLite by default, with PostgreSQL as an option. A small Vite-built frontend handles the editor, WebSocket synchronization, themes, and client-side encryption. The optimized frontend is embedded into the Go program, so cowyo can still be downloaded and run as a single executable.

The whole project is open source. You can read the code, run it yourself, or contribute at github.com/schollz/cowyo.