DumbPad is a self-hosted notepad for the web: open a page, start typing, and the text saves itself. There are no notebooks, no accounts and no database to look after — each note is a plain text file in a data directory, and the whole app is a single Node.js process you can run from a one-line Docker command. It is deliberately small in scope: a fast editor for quick notes, with an optional Markdown preview and an optional PIN in front of the whole instance.
+ button, a dropdown to switch between them, and automatic name de-duplication on the server so two notepads never collide.Ctrl+K), which is how you navigate once you have more than a handful of notes..txt or .md, or print it with collapsible sections auto-expanded so the printout contains everything.The Markdown toggle cycles through three modes — editor only, split view with the source and the rendered page side by side, and full preview — and you can pick the default in settings. The renderer goes past stock Markdown: GitHub-style alert blocks (note, tip, important, warning, caution), extended tables, collapsible <details> blocks, and syntax highlighting for around 180 languages through highlight.js, which can be narrowed to a fixed list with the HIGHLIGHT_LANGUAGES variable if bundle size matters.
Notepads are kept in sync over WebSocket, so two browsers on the same notepad see each other’s edits as they happen. Storage is a directory of .txt files plus a notepads.json index — back it up with a copy, move it between machines, or drop your own .txt files in to import them on the next page refresh. Nothing is rendered or stored in a database, which is what keeps the footprint this small.
By default DumbPad has no login at all, which is fine on a trusted LAN and a bad idea on the open internet. Set DUMBPAD_PIN to a 4–10 digit PIN and the whole instance sits behind it, with constant-time comparison, five attempts before a 15-minute lockout tracked by client IP, and secure cookies. Behind a reverse proxy, either leave TRUST_PROXY off or set TRUSTED_PROXY_IPS explicitly — trusting X-Forwarded-For from anywhere lets a client spoof its address and sidestep the rate limiting.
The image is on Docker Hub as dumbwareio/dumbpad. Mount a data volume, publish port 3000, and set BASE_URL to the address you will browse it on. One gotcha is documented at length in the README: as of a recent release the container runs as a non-root user with UID 1000, so the host data directory must be owned by that UID or the app exits with EACCES: permission denied on startup. Configuration is a short list of environment variables — PIN, site title, allowed origins, lockout window, cookie ages.
DumbPad is for the note you want to jot down in three seconds and find again later: server notes, snippets, a scratch pad shared by everyone on the LAN. It is not a knowledge base — no wikilinks, no backlinks, no graph, no tags, and no per-user accounts. If you need structure or collaboration between people who should not see everything, a different tool is the better fit.