A personal productivity suite in a single HTML file: notes, planner, finance, learning, tools and many more modules, inspired by YunoHost.
ProductivityHTML · JavaScriptGitHub @chiutaOnlineOwner unconfirmed
Have you tried it? One tap is enough. No sign-in needed.
GitHub star growth between the latest completed 8-hour observations
DeepSeek Harness Remote can securely connect a phone or another computer to the computer where you run DeepSeek Harness, so you can continue your work anytime and anywhere, check progress anytime, and continue working.
AI translation
Ayakaleaf Pro is a free, open-source, self-hosted Overleaf alternative: Overleaf Community Edition with almost all Server Pro features — track changes, project history, admin panel, SSO, Git-bridge, Z
Open-source desktop app to view and edit HWP/HWPX documents on macOS, Windows, and Linux
AI summary · website content
A modern, high-performance local file search and productivity tool for Windows. A sleek, customizable alternative to Everything and Listary built with C# WPF and NT Services, featuring instant NTFS MF
Owners of public repositories under a personal GitHub account can sign in to verify ownership and manage the introduction themselves. No administrator approval is needed.
Sign in, generate a verification file, and commit it to this repository’s default branch within 30 minutes. Files on other branches or forks do not count. Then check the file below to manage the project without administrator approval. Keep the file to retain your access.
If needed, you will go to sign-in. After signing in, return here and press your chosen verification button again.
Run /nomorevibe verify in your project folder to verify ownership and manage the introduction yourself.
Verify in one minuteAsk about other verification options
All-in-one productivity suite with 141 modules; your data stays in the file.
Taken from the repository README
Loading the full README.
Read the full README ↗English · Română · Français · Italiano · Español · Português · Deutsch · Magyar
Version: 2.2.0 · Last updated: 2026-10-27
Status: stable · Offline: needs internet for weather, dictionary and translation (only on request)
A personal productivity suite in a single HTML file ("quine"): notes, planner, finance, learning, tools and many modules, inspired by YunoHost.
Live: https://chiuta.github.io/OmniHost/
OmniHost is an index.html file (~4.0 MB) that works as a complete personal application, with no server and no account. The data is kept in a JSON object inside the file (omnihost-store); the "Save" button downloads a copy of the app with all the data embedded. The interface shows "141 Modules", and the description on the page calls it "Single-File Sovereignty". The default interface is in English.
The sidebars group the modules (with the number of items shown in the app):
Ctrl/Cmd+K).Ctrl/Cmd+K, theme and language, Save (where your data lives) and privacy. It is opt-in, only highlights existing controls, saves nothing and sends nothing; Esc or "Close tour" ends it; it works on phone-width screens (the dialog becomes a bottom sheet). It answers the concern that 141 modules can discourage a newcomer: start with the Dashboard and Notes, hide the rest with a workspace.Ctrl/Cmd+K (or 🔍) searches the 141 modules by name and group (since 1.3.1) and, since 2.0.0, also your local data; workspaces (2.0.0) hide the pages you do not use.vendor/jsQR.js (0.26 MB) is separate.Ctrl/Cmd+K switcher: below the module list a section "In notes and journal" appears (BM25, typo tolerance, diacritics ignored); a click or Enter opens the note or journal entry..fff.json backup (shared "fff-kit" module, local, no network): it opens from the dialog that appears when you click the version in the footer (export, password-encrypted export, import with confirmation, deletion of the app data). The backup covers the app database (omnihost_db); on import, the imported copy takes priority over the data in the file. An export marks the "last backup".fff.config.json marks the app as "self-modifying" (the Save button downloads a copy with the data embedded); the kit's dialog warns that the hash of the saved copy differs.index.html. On the Dashboard, go through the discovery tasks in the "Tasks" list.localStorage uses the key omnihost_db (after "Save" it is rebuilt automatically, so that the .fff.json copy can include it). Unless you export it encrypted, the .fff.json copy contains the app's passwords and secrets as plain text: use the password-encrypted export.connect-src) to four hosts; all of them go out only after an action of yours:
geocoding-api.open-meteo.com and api.open-meteo.com — the weather card on the Dashboard is OFF by default; on clicking "Show local weather" (opt-in, remembered in the settings in the file; it can be turned off with "Turn weather off"), the city deduced from the browser's time zone is sent for geocoding, then the coordinates for the forecast; the results are cached for 30 minutes. Without a click, no request goes out at load;api.dictionaryapi.dev — only when you use the dictionary lookup (the searched word; possibly the pronunciation sound from the same host);api.mymemory.translated.net — only when you use the translation in Utilities (the text to translate).localStorage (omnihost_db); the "Encrypt" module is separate. The protection in the browser is only cosmetic (the note also appears on the Passwords page). The sample entries are public test credentials (the Stripe keys from the documentation were replaced with a placeholder). Do not store important passwords here on a shared computer and do not distribute the saved file.A personal organization tool, for information only. The modules in the "Health" and "Finance" groups (symptom journal, allergies, supplements, financial calculators, tax estimator etc.) do not provide medical or financial advice and do not replace a specialist. The quotes and sample texts in the wiki are demonstration content and have not been checked for attribution.
Download index.html (and the vendor/ folder, which contains jsQR.js for the QR scanner) and open it in a browser. Almost all the modules work without internet; weather, dictionary and translation need a connection.
MIT — see the LICENSE file. The "Licenses" page in the app, the file header and the wiki texts say the same (MIT). Third-party components (e.g. jsQR, qrcodejs) remain under their own licenses, listed on the "Licenses" page. NOTICE: the complete list of embedded third-party components (jsQR 1.4.0 Apache-2.0; the fonts JetBrains Mono, DM Sans, Playfair Display under SIL OFL 1.1; the Trade-Free logo; online services) with versions and copyrights is in NOTICE.md.
2026-10-10: verified in the browser (0 JS errors; at that date there was an automatic request to Open-Meteo, now removed). Fixed a stored XSS (the priority fields of tasks and module of the feed) that could be triggered through a malicious JSON import, plus accessibility (names for controls, contrast, Markdown lists). Round 2 (2026-10-11): the license unified to CC0 (the "Licenses" page, wiki, flashcard); the weather on the Dashboard is now opt-in (no automatic request at load); the static text "nothing is sent anywhere" in the About card was aligned with the one in i18n; the Stripe test keys replaced with a placeholder.
tests/lazy-i18n.test.mjs (16 checks). File 5.45 → 4.04 MB. Lazy loading of the module code itself remains planned.tests/tour.test.mjs (38 checks, desktop and 360 px).pointer:coarse) small buttons, selects, text fields and the sidebar navigation are at least 44×44 px (they were 23–36 px). No change on desktop.Security: no more inline handlers, strict CSP, optional master password.
onclick=, onchange=, oninput= etc., in the static HTML and in the JS templates) were replaced by data-act / data-a1… attributes and a single dispatcher on document that calls functions from a whitelist table (455 actions). Behaviour is unchanged (checked by an automatic equivalence reader: 1,190 of 1,191 distinct sites identical, the only difference being the random password generator).'unsafe-inline' was removed from script-src (only 'self' blob: and sha256 hashes of the real inline scripts); the exception was removed from fff.config.json; fixcsp, info and the strict check pass without exceptions. “Save Minified” no longer rewrites scripts (it would invalidate the hashes). style-src still allows 'unsafe-inline'..fff.json copy keeps these fields encrypted. There is no recovery: a lost master password cannot be reset except by erasing the protected data.confirm/prompt dialogs were replaced by in-page dialogs (shared dialog module); interface translations completed (i18n parity).NOTICE.md (third-party components). Fixed: the Scratchpad download used document.URL by mistake.tests/master-pw.test.mjs (new), audit-r10, fff-r8 and restore-r6 updated/passing.fff-kit 1.1.4: touch targets and minimum text size; touch targets and text size corrected.
1.3.7 — 2026-10-22: security. The data (localStorage, the copy embedded in the file and every imported JSON or .fff.json backup) is now validated against a schema: IDs must match ^[A-Za-z0-9_-]{1,64}$, types and sizes are checked, unsafe keys (__proto__ …) and texts are repaired or removed, with a message in 8 languages. Every value coming from the data and placed in an inline handler or a template is escaped (jsa()/esc()), so a hostile backup can no longer run code or read localStorage.omnihost_db. The unencrypted .fff.json copy of the kit no longer contains passwords, 2FA keys or vault entries (the copy made with a password stays complete and encrypted); a note in Settings explains it. Not done: the CSP still has 'unsafe-inline' (about 1,390 inline handlers remain; their migration to addEventListener is a larger refactor). New test: tests/audit-r10.test.mjs.
1.3.6 — 2026-10-22: fff-kit 1.1.2: PBKDF2 600,000 iterations, anti-clickjacking protection
1.3.1 — 2026-10-19: the quick module switcher (Ctrl/Cmd+K, the 🔍 button) with the search in notes and journal, the automatic accessible names for controls without a label and the "last backup" hooks of the .fff.json copy (all described above) are present in the current version: they had been removed by mistake in an earlier cleanup and were restored, with their texts now in 8 languages. Fixed: script hashes added to the page's CSP next to 'unsafe-inline' made the browser block every inline handler (onclick= etc.); the hashes were removed and the CSP keeps script-src 'self' 'unsafe-inline' blob: as before.
1.1.0 — 2026-10-14: fuzzy search in notes and journal in Ctrl/Cmd+K (FFF.search); .fff.json copy through the shared modules (core, label, bundle, search); new tests: tests/fff-r8.test.mjs.
1.0.0 — 2026-10-12: the version and the date of the last update are shown in the app (first numbered version; in the sidebar, with a label translated into the 71 languages).
Round 7 — 11 October 2026.
load event offline (in the test, load fires at ~0.9 s, network blocked).Round 6 — 11 October 2026.
Ctrl/Cmd+K or the 🔍 button in the top bar; it searches among the 141 modules by name or group, navigation with ↑↓, Enter opens. The Esc key now closes any dialog.aria-live) below the output field for success/failure, not just a toast.outerHTML, and "minify" rewrites the script, so a hash-based CSP would invalidate the saved files.Round 5 — 11 October 2026.
complementary landmark.onclick= etc.) remain; the quality of the translations into the 71 languages cannot be verified.Alexio — Alexandru-Ionuț Chiuță. Contact: [email protected]
OmniHost is a single-file "quine" personal productivity suite (notes, planner, finance, learning, tools, security and more; 30 themes; UI in 71 languages). Data lives inside the HTML file and in localStorage (omnihost_db); "Save" downloads a copy with data baked in. Network use is limited to Open-Meteo (dashboard weather, opt-in), dictionaryapi.dev (dictionary) and MyMemory (translation). MIT licence.
<script type="application/json" id="oh-lp-xx">I18N.xxeval, no extra decompression layertests/lazy-i18n.test.mjsUIX_DICT, ~0.2 MB) and the translated wiki seed (0.7 MB of JSON) are still parsed at start. Splitting the module code in a single-file "quine" would need a loader for deferred blocks and a careful audit of the dependencies between modules (global state, inline-handler whitelist OH_ACT), which could not be done safely in this round. Workspaces still reduce what you see, not what the browser parses.