The full story · Go version with my brother, Feb to Aug 2026 · Java rebuild Nov 2026, solo

patrn.ink

A link shortener whose redirects anyone can verify.

122JUnit tests, plus 15 browser tests

13architecture decisions written down

0IP addresses stored

4 GBof memory runs the whole thing

The hard parts

Proving a link was not quietly changed

Problem: A short link can be pointed somewhere else later, and nobody would know.
What I did: Every change goes into a signed, tamper-evident log in the same transaction as the link itself, and your browser checks the proof of a link's history.

Analytics without tracking people

Problem: Counting unique visitors usually means storing IP addresses.
What I did: Clicks are rolled up daily, and visitors are counted with a hash whose key changes every day, so nobody can be followed across days.

Visiting strangers' links safely

Problem: Checking a destination means the server visits addresses chosen by strangers.
What I did: One small separate service is the only thing allowed to fetch them. It checks every address it connects to and every redirect, and limits how long and how much it reads.

Also in it

Password and age gates, schedules, expiry and rotation between destinations
Scoped API tokens and rate limits
Health checks that pull broken destinations out of rotation
QR codes, bulk import and export
A read-only guest demo with sample data
Release checks for accessibility, performance, security and image vulnerabilities

Built with

GitTypeScriptHTML and CSSAutomated testingReactJavaRESTAWSDockerSpring BootNext.jsDocker ComposeArchitecture decision recordsKubernetesRedisGitHub ActionsOIDC federationGoTailwind CSSRate limitingDynamoDBNginxAccessibilityOAuth 2.0 / OIDCJWTPlaywrightJUnitGinOpenAPISpring ModulithGraalVMCachingSQSTransparency logOWASP ZAPTrivyLighthouse CI

More screens

Honest gaps

Real cold-start and redirect speed are not measured yet, and the log has no outside witnesses yet.

Watch the demo Open it live (starts in a minute or two)All projects