Tiny Little Office: Open-Source No-Login Productivity Suite That Stores Documents in URLs

Now, veteran developer and technology writer Paul Ford, along with his software company Aboard, has released an intriguing counter-proposal called Tiny Little Office. Reported by TechRadar and detailed in the project's public MIT-licensed GitHub repository, Tiny Little Office is a free, open-source, browser-based suite of 10 productivity tools built around a deceptively radical premise: the link is the document. There are no logins, no user accounts, and by default, no server-side databases holding your files in the clear. Instead, everything you write, calculate, or draw is compressed and packed directly into the web address sitting in your browser's URL bar.

Coming hot on the heels of other AI-assisted software experiments—such as developer Brandon Thomas's recent Claude-generated clones of Adobe and Microsoft Office apps —Tiny Little Office arrives at a moment when "vibe coding" and AI-assisted development are challenging how fast small teams can ship functional software. Yet reducing Tiny Little Office to just another "vibe-coded Microsoft Office clone" misses what makes it genuinely interesting for Windows users, privacy enthusiasts, and IT pros. It is not a drop-in replacement for desktop Word or Excel; rather, it is a clever, deliberate return to passing digital notes in class, backed by a surprisingly rigorous cryptographic threat model.

What Exactly Is Tiny Little Office?​

According to TechRadar's reporting, the conceptual roots of Tiny Little Office go back six years, when Ford's colleague Rich Ziade built TinySheet—a minimalist, 10-line browser spreadsheet—followed by a similar tool called TinyCalendar. Those early experiments were eventually shelved and their domains expired, but Ford noted that modern tooling has made it "easier to build small than ever before," inspiring the team to resurrect the concept as a full 10-app suite. While the exact proportion of AI-written code versus hand-crafted architecture isn't specified, TechRadar notes that Anthropic's Claude Code assisted with at least part of the development, and the project's GitHub repository includes native hooks and skills specifically designed for AI agents.

When you open Tiny Little Office in Edge, Chrome, or Firefox, you are greeted with 10 distinct web applications, as documented in Aboard's GitHub repository:

• Word Processor: Supports formatted text, titles, task lists, footnotes, and tables that can calculate sums.
• Outliner: Built for structured, hierarchical note-taking and talk tracks.
• Presentation Builder: Features slide layouts, two-column views, charts, and speaker notes.
• Spreadsheet: Handles tabular data, basic formulas, and bar charts.
• Calculator: A conversational, multi-line calculator designed for tasks like splitting restaurant bills with tax and tip.
• Drawing Tool: A canvas for freehand sketches and visual explainers.
• Diagram Maker: Tailored for organizational charts and structured flowcharts.
• Animator: A lightweight frame-by-frame animation utility.
• Calendar: A clean weekly or event-based schedule builder.
• Trip Planner: An itinerary tool with optional map integration via OpenFreeMap and OpenStreetMap.

The suite supports 21 languages—which the repository dryly describes as "mostly the ones we speak in NYC"—and runs entirely as a client-side web application.

How "The Link Is the Document" Actually Works​

To understand why Tiny Little Office behaves so differently from Microsoft 365 or Google Docs, you have to look at the anatomy of a web address. In a traditional cloud office suite, a URL is merely a pointer—a street address that tells your browser which file to fetch from Microsoft's OneDrive or SharePoint servers after verifying your Entra ID or Microsoft account credentials.

Tiny Little Office flips this architecture on its head. According to the project's official threat-model documentation on GitHub, the entire document payload is compressed and placed into the URL fragment—the portion of the web address that appears after the # symbol (formatted as [Tiny Little Office](https://tinylittleoffice.com/)<app>/#/v1/<app>/<payload>).

Why does the # symbol matter so much? By foundational web standards, browsers do not send the URL fragment to the web server when requesting a page. When you open a Tiny Little Office link, Aboard's Cloudflare-hosted server simply delivers the static application files (the HTML, CSS, and JavaScript for the word processor or spreadsheet). Once that code loads locally in your browser, it reads the compressed string after the # symbol and renders your document on your screen. The host server never sees the fragment, which means it never sees your document, its title, or its contents.

As you type or edit cells, the browser dynamically updates the URL string in your address bar. When you want to share the file, you simply copy the URL and paste it into Signal, Slack, Teams, or an email.

However, as Ford candidly pointed out to TechRadar, this introduces a completely different workflow than modern cloud users are conditioned to expect. "It's not collaborative like Google Docs," Ford explained. "It's collaborative like handing out zines at a street fair."

When you send a link to a colleague, you are handing them a standalone clone of your file. If they open the link and start changing numbers in the spreadsheet, their browser generates a brand-new URL in their own address bar. Their changes will never sync back to your screen unless they copy their newly mutated link and send it back to you. There is no central "source of truth" on a cloud server—every link is an independent artifact.

Comparing the Architecture: Tiny Little Office vs. Cloud Suites​

For Windows users accustomed to conventional productivity software, the architectural differences can be summarized by looking at how data flows—or doesn't flow—across the network:

Under the Hood: The Real-World Privacy and Security Tradeoffs​

It is tempting to read "no logins and local-only storage" and assume a tool is a magical privacy cloak. To Aboard's credit, the Tiny Little Office GitHub repository includes an exhaustive, remarkably transparent threat-model.md document that refuses to make lazy marketing claims. In fact, the documentation quotes Ford directly on why absolute claims are dangerous: "Saying we never save anything is wrong; we should say that's the default."

If you are considering using Tiny Little Office for sensitive scratchpad work on your Windows PC, here is what the project's technical documentation reveals about how its privacy protections actually work—and where the sharp edges lie.

1. Whoever Has the Link Has the Document​

Because the URL contains the entire document, the link itself is sensitive data. If you paste an unencrypted Tiny Little Office link into a corporate Slack channel, a Discord server, or an unencrypted email, that chat provider, your clipboard manager, and any link-preview bots on the channel now hold a copy of your document. Furthermore, because the document lives in your browser's address bar, your browser's local history—and its cloud history sync, if you are signed into Edge or Chrome—will record snapshots of the document URL every time you pause typing for 15 seconds or switch tabs.

To mitigate this, Tiny Little Office offers password protection. Instead of letting users pick weak passwords like Password123, the app generates a high-entropy password (roughly 116 random bits) and uses WebCrypto's AES-256-GCM with an HKDF-SHA-256 key derivation pass to seal the payload. When a document is locked with a password, its title and contents are hidden from the browser tab title, browser history, and local storage library. Of course, as the documentation dryly warns, if you paste the generated password into the exact same chat message as the link, you have defeated the entire purpose.

2. The Short-Link Exception​

Because encoding an entire multi-paragraph document or spreadsheet into a URL creates a massive, unwieldy block of text that looks terrible in chat apps, Tiny Little Office offers a URL shortener (tinier).

Using a short link is one of the two opt-in exceptions where data actually touches Aboard's Cloudflare servers. However, the project's documentation specifies that before the link leaves your browser, it is encrypted locally using AES-256-GCM with a random decryption key. The server stores only the encrypted ciphertext, an initialization vector (IV), and an expiration timestamp (ranging from an hour to a month, swept hourly) in a Cloudflare D1 database. The decryption key is never sent to the server; instead, it is appended to the short link's own # fragment. Once created, a short link is immutable—neither you nor the server operator can edit or recall it before its expiration timer runs out.

3. The Social Preview Card Exception​

The second server-side exception occurs if you use the built-in social sharing menu (for Bluesky, Mastodon, X, or LinkedIn) and leave the "Show a preview of the first page" toggle turned on. Because social networks cannot execute client-side JavaScript to read a URL fragment and generate a preview image, choosing this option sends a picture of the document's first page, its title, and its first 200 characters to Aboard's server to generate an unencrypted preview card (/c/<id>). That preview card remains readable on the server for a month before being deleted. Standard link copying, email sharing, and password-protected documents never generate preview cards.

4. Zero Telemetry and Phishing Guards​

From a security engineering standpoint, some of the most impressive details in Tiny Little Office are the things it refuses to do. According to the repository's threat model, documents cannot load external images or embeds from the web, completely eliminating the risk of invisible tracking pixels alerting a sender when you open a file. The only external network requests a document can trigger are optional map tiles from OpenFreeMap and OpenStreetMap when using the Trip Planner.

Additionally, to prevent bad actors from using URL-encoded documents as serverless phishing lures, Tiny Little Office never renders a document as an executable web page, and it includes a strict "link guard." Clicking any external hyperlink inside a document triggers a large warning modal displaying the exact destination domain and full left-to-right URL, with "Cancel" pre-selected as the default action.

The "Vibe Coding" Debate and the Developer Angle​

Tiny Little Office's arrival also highlights a growing schism in how we talk about AI-assisted software development. Earlier in October 2026, when developer Brandon Thomas used Claude Opus 5.5 to crank out free clones of Adobe Creative Cloud and Microsoft Office apps, the reception on Reddit and across the open-source community was fiercely divided. Critics argued that generating stripped-down clones of Word or Photoshop ignores decades of hard work poured into established open-source powerhouses like LibreOffice, GIMP, and Inkscape—projects that handle complex print color profiles, sprawling .docx and .xlsx compatibility, and enterprise accessibility.

Why didn't Tiny Little Office trigger the same eye-rolling? Because Ford and Aboard didn't try to clone the bloated surface area of Microsoft Office 365 just to prove an AI could draw a Ribbon interface. Instead, they built a cohesive, opinionated tool around a specific architectural constraint—serverless, URL-borne documents—and backed it up with verifiable engineering.

Furthermore, rather than just using AI to write code, Aboard designed Tiny Little Office to be used by AI agents. According to the repository's README, automated agents have three documented ways to interact with the suite:

1. Fetching /llms.txt to understand the suite's structure.
2. Running the command-line package via npx tinylittleoffice alongside its document runtime.
3. Installing a dedicated Claude Code skill via npx tinylittleoffice skill --into ~/.claude/skills, allowing an AI coding assistant in your terminal to generate shareable spreadsheets, diagrams, or outlines as portable URLs.

For developers and technical users who don't want to take Aboard's word that the live site at tinylittleoffice.com matches the public GitHub code, the repository requires Node.js 24 or later and supports reproducible, attested builds. Running npm run verify-deploy allows anyone to compile the exact git commit listed in the live site's /version.json file and verify byte-for-byte that the Cloudflare host hasn't injected rogue scripts to siphon off URL fragments. And if you want total control on your own Windows machine or home lab, the entire suite can be run locally at [url]http://localhost:4178[/url] via npm run dev, self-hosted as a single Node process over a SQLite file, or accessed via a static GitHub Pages mirror if the main domain ever goes offline.

Practical Takeaways for Windows Users​

Should you uninstall Microsoft 365 or LibreOffice today and move your company's quarterly financial modeling into Tiny Little Office? Absolutely not. If you need complex VLOOKUPs, pivot tables, VBA macros, multi-megabyte image embeds, .docx track-changes compatibility, or centralized corporate compliance, this tool is not built for you.

Instead, Tiny Little Office shines as a frictionless digital scratchpad—the ultimate evolution of notepad.exe for the browser era. It is ideal when you want to:

• Jot down a structured outline or meeting agenda and drop it into a Signal or Slack chat without forcing recipients to log into a cloud account or request view permissions.
• Split a group dinner tab or rent calculation with a quick bar chart and hand everyone an interactive copy they can tweak on their own phones.
• Draft a quick organizational diagram or presentation deck on a shared or locked-down PC where you don't want to sign into your personal Microsoft or Google account, leaving "Save in browser" turned off so nothing persists when the window closes.

In an era where almost every piece of software demands an email address, a cloud sync daemon, and a monthly subscription just to let you type a paragraph, Tiny Little Office is a refreshing reminder that the web browser is already a remarkably capable operating system—and sometimes, a simple link is all the cloud you actually need.