URL as File: AI Coding Reshapes Software Storage and Privacy

When Files Disappear, URLs Become the New Carrier

In the latest episode of The Vergecast, host David Pierce sat down with Paul Ford, co-founder of Abord, for an in-depth conversation about "where the computer lives." Ford's recently launched experimental project tinylittleoffice.com has drawn widespread attention: it packs the entire data of documents, presentations, and even spreadsheets into the URL itself, with no reliance on server storage. It sounds like magic, but behind it is a fundamental rethink of the nature of the Web.

Ford explains that a URL is essentially just a string of characters, theoretically capable of carrying unlimited data. Modern browsers and social platforms tolerate long URLs far more than expected—Bluesky's URL limit, for instance, is around 4096 characters, enough to hold several pages of text. So an "office suite" gets compressed into a minimalist variant of Markdown, then compression-encoded, ultimately becoming a long string of link that looks like gibberish. When a user copies and pastes that link, they're passing along the complete file.

"A URL isn't just an address—it can be the data itself." —Paul Ford

The Other Side of Privacy: Data Never Leaves the Browser

The most immediate benefit of this design is privacy. Content after the hash symbol (#) in a URL is by default not sent to the server and is only parsed locally in the browser. So when users edit documents with tinylittleoffice, all data stays on their own device. Combined with incognito mode and encrypted messaging tools (like Signal), the entire sharing process can be end-to-end traceless.

Ford emphasizes that browsers' built-in encryption capabilities are already very mature—he directly calls on AES-256 post-quantum encryption to protect an optional password feature. Since the entire application is a single JavaScript file, the security boundary is clearly visible, and anyone can review the code.

However, this model also upends the traditional concept of ownership. Once a URL is shared, the document no longer belongs to its creator. When the other party opens the link, what they see is their own copy, which they can save and forward at will. Ford sees this as precisely its value: it's built for group chats, temporary collaboration, and short-lived material, not as a replacement for Google Docs in everyday office work.

The URL fragment identifier is the formal name for the # symbol and the content following it. According to the HTTP specification, browsers strip the fragment portion when making a request, so the server never sees data after #. This feature was originally used for in-page anchor navigation, and is now used by tinylittleoffice as a data container: document content is encoded and placed after #, and when the page loads, JavaScript reads location.hash and decodes and renders it. It's worth noting that although fragment data doesn't enter HTTP requests, it can still appear in browser history, clipboard sync, or screenshot sharing, so it isn't absolutely secure and still requires additional measures like incognito mode.

AES-256 is currently the mainstream standard for symmetric encryption, with a key length of 256 bits, widely used in scenarios such as TLS and disk encryption. "Post-quantum encryption" in this context usually refers to adopting symmetric encryption schemes that can resist quantum computer attacks—AES-256 itself is considered quantum-resistant, because Grover's algorithm only provides a quadratic speedup against symmetric keys, and a 256-bit key still retains about 128 bits of security strength. Ford building the password feature on AES-256 means that even if quantum computers become practical in the future, the confidentiality of encrypted documents won't be easily broken, which is especially critical for scenarios where links are passed through untrusted channels (such as public group chats).

AI Coding Gives "Small Software" New Life

The core force enabling tinylittleoffice to exist is AI-assisted programming. Ford reveals that he completed this project—which includes word processing, spreadsheets, an outlining tool, and presentation software—in just about 20-30 hours, most of it on a commuter train. In the past, building such a suite of tools would have required substantial resources with extremely low potential commercial return, so almost no one would do it.

AI coding tools dramatically lower development costs, making "small effort for small software" reasonable again. Ford says he spent considerable effort designing the architecture so that the command system would be as elegant as possible for automated evaluation. The browser's own capabilities are also far beyond what they once were: the encryption, networking, 3D, and audio features built into Chrome and Safari, which once primarily served large tech companies, are now easily accessible to ordinary developers.

But Ford also warns that this model isn't without risk. Malicious developers could secretly send data to other servers in JavaScript, so open source and code transparency are crucial. He welcomes security researchers to "find flaws," believing this is the only way to build trust.

Compression algorithms are a key link in having URLs carry data. Text-based documents are first converted into a minimalist Markdown variant, with redundant markup removed, then compression-encoded (such as deflate or custom dictionary encoding) into Base64 or a similar character set before they can be safely placed in a URL. The compression ratio directly determines how much content a link can hold: Bluesky's limit of about 4096 characters can, under efficient compression, hold several pages of plain text, but images and binary files are nearly impossible to fit. This is also the fundamental reason Ford explicitly states the project isn't suitable for rich-media documents—the URL's character budget is a new, extremely scarce storage resource.

The Paradigm Shift from "Files" to "Links"

Traditional file management relies on folders, cloud drives, and permission systems, while tinylittleoffice simplifies all of this into a single link. Ford candidly admits that Google Drive's mess is frustrating, and URL files offer a "use-and-discard" sense of cleanliness. It's more like a "story" on social media: you know it won't last forever, which makes you more willing to share it casually.

This paradigm also sparks discussion about the definition of a "blog." Ford imagines whether, if someone posts a document link on Bluesky every day, that counts as a blog. Technically, it lacks the ability to host images and audio, but the data exists in only one place—deleting the post deletes everything. This kind of lightweight coordination tool may well be a form of future information sharing.

Of course, the limitations are obvious too: images and large files are hard to fit into a URL, and handling compressed files on mobile isn't convenient. Ford says the project will continue to improve navigation and chart efficiency, but the core philosophy won't change: stay transparent, have no hidden agenda, and don't commercialize. tinylittleoffice uses the MIT license, effectively entering the public domain, and Ford hopes more people will build their own "small apps" on top of it.

In the AI era, the question "where is the computer" has a new answer: it may be right there in the address bar, in the link you casually paste, quietly running locally in the browser. This extreme lightness and privacy may well be a rebound worth paying attention to after we've grown weary of massive cloud services.

One-line Summary

tinylittleoffice packs documents into URLs, exploring a new paradigm of privacy, lightness, and AI coding.

Paragraph Summary

In The Vergecast, David Pierce and Paul Ford discuss the experimental project tinylittleoffice.com: it compresses and encodes the data of documents, presentations, and spreadsheets into the URL itself, with no reliance on server storage. Since content after # in a URL isn't sent to the server, data always stays local in the browser; combined with AES-256 encryption and incognito mode, this enables highly private sharing. The project was completed in just about 20-30 hours, thanks to AI-assisted coding dramatically lowering development costs. Ford sees this "use-and-discard" link file as suited for group chats and temporary collaboration rather than replacing Google Docs, at the cost that sharing means giving up ownership. The project uses the MIT license, emphasizing open-source transparency and security review.