Pentest scratchpad - Markdown editor with live preview, tag-based organisation, full-text search, pentest templates, 2-second auto-save, multi-format export.
WebPad is the persistent notebook tied to your account - the place every bug-bounty / pentest engagement’s working notes live until they’re ready to become a formal report. Built around what testers actually do: jot a payload mid-test, paste a captured request, sketch the steps to a finding, build an OWASP-style checklist, log a day of recon.
Real Markdown editing with three view modes (Edit · Preview · split Edit+Preview), 2-second auto-save in the background, full Markdown rendering with GFM tables, task lists ([ ] / [x]) and syntax-highlighted code blocks. YAML frontmatter at the top of any note carries tags: and pinned: metadata that powers organisation - tag chips filter the sidebar, pinned notes float to the top.
Full-text search over title and content across every note in your account, with highlighted match snippets - type 2+ characters in the sidebar search to find every note that mentions jwt or target.com or idor. Server-side indexed (LIKE-based) so it’s instant.
5 pentest-specific templates bootstrap common note shapes: Recon log (daily journal with target / subdomain enum scaffolding), Bug write-up (severity-tagged shell with CWE / asset / steps / impact / fix), Engagement summary (period, scope, methodology, findings index), Quick reference (empty scratchpad), OWASP testing checklist (60+ pre-filled [ ] task items across recon, auth, access control, injection, business logic, crypto, file upload).
Server-side per-user storage in your Arsenly account - saved to a 2 MB-per-note SQL row, visible only to you, available across devices and sessions.
`inline code`, fenced code blocks with language tag, ordered & unordered lists, GFM tables, blockquotes, horizontal rules, [task lists](https://github.github.com/gfm/#task-list-items-extension-) ([ ] / [x]), HTML-escape-safe.----fenced header at the top of a note carries tags: xss, sqli and pinned: true. Tags are parsed into chips, pinned notes float to the top with a 📌 marker..md (raw Markdown), .html (rendered styled HTML, fully standalone), or .txt (plain text with formatting stripped).subfinder / httpx output into code blocks, tick off the checklist items as you complete them..md and paste into HackerOne / Bugcrowd.pinned: true so it floats to the top, link daily child notes from the Findings index table.Server-side in your Arsenly account database, on a per-user row. Title (up to 120 chars), content (up to 2 MB per note), and an updated-at timestamp. Visible only to you. 500 notes maximum per account.
Type a YAML frontmatter block at the very top of a note: ---<newline>tags: xss, sqli, target-com<newline>---. The tags input above the editor mirrors this for convenience - you can edit either place. Tags become filter chips in the sidebar when you focus a tagged note.
2 seconds after you stop typing, the note silently saves to your account. The status indicator shows "● Unsaved" while editing, "Saving…" briefly, then "✓ Saved". Ctrl+S forces an immediate save without waiting.
Notes are stored on our server, encrypted-at-rest at the database layer. They are tied to your account and visible only to you. Do not store real production credentials, customer PII or anything you wouldn’t want recoverable from a database backup. Use the local-only Hash Toolkit or KeyHacks for live-secret work.
Search runs against the server-side stored copy. The note you’re currently editing only becomes searchable after the next save (2 s auto-save or Ctrl+S).