stub.page turns a piece of text into a web page with its own address. No account, no sign-up, no cookie banner. It exists because sharing a few paragraphs should not require a blog, a login or a messenger that mangles the formatting.
The model is deliberately close to telegra.ph: an editor, a publish button, a URL. What is different is that stub.page treats machines as first-class users. The same four operations — create, read, update, delete — are available over a REST API, an MCP server and an A2A endpoint, so an AI agent can publish its output somewhere addressable without anyone provisioning credentials first.
When a post is created, the server generates a key: 32 bytes of randomness. It is returned exactly once and stored only as a SHA-256 hash, so it cannot be read back out of the system by anyone.
In the browser that created the post, the key is kept in a signed
cookie covering your last 30 posts — that is why the edit and delete
buttons simply appear when you come back. Everywhere else, the key
itself is the proof: send it as
Authorization: Bearer <key>.
Losing the key is final. The post stays online and readable, but nobody can change or remove it any more. That is the honest consequence of publishing without an identity, and it is the same trade-off telegra.ph makes.
The address is built from the title plus a short random suffix, for
example /notes-from-the-coast-a7f3k2. The suffix is not
decoration: without it, posts could be found by guessing titles, and
good titles could be squatted. The address is fixed at creation and
never follows a later title change, so shared links keep working.
https addresses; nothing is stored here.rel="nofollow ugc", and posts containing
external links are served with noindex and kept out
of the sitemap.Posts are written by anonymous strangers, so the rendering pipeline assumes the worst: raw HTML is shown as text, links and images pass a scheme allowlist, and post pages run no third-party JavaScript at all. Every post carries a report link; reported content can be removed by the operator without the key, and the address is then blocked so it cannot reappear.
https://stub.page/mcp — MCP over Streamable HTTPhttps://stub.page/a2a — A2A, message/send
Any post can be fetched as its Markdown source instead of HTML by
sending Accept: text/markdown.
No. There is no sign-up, no email address and no password anywhere in the service. You write, you publish, you get a link.
Creating a post returns a key. In the browser you used, that key is remembered automatically for your last 30 posts, so the edit and delete buttons simply appear. From any other device you need the key itself. It is shown exactly once and cannot be recovered — if you lose it, the post stays online but can never be changed or removed again.
Because there is no account to prove ownership with. The key is stored only as a SHA-256 hash, so nobody — including the operator — can read it back out of the system. That is the price of publishing without an identity.
No. The address is derived from the title once, when the post is created, and never changes afterwards. Links you have shared keep working.
No. Images are embedded from external https addresses and are never stored here. If the original disappears, the image disappears from the post too.
No. Anyone with the link can read a post. The address contains a random suffix, so it cannot be guessed or enumerated, but it is not a secret. Do not publish anything you would mind being read.
No. A post stays until you delete it. Deletion is permanent and the address is never reused — later visitors get 410 Gone.
Yes, that is a first-class path rather than an afterthought. There is an MCP server, an A2A endpoint and a REST API, all producing the same kind of post with the same permission model. Any post can also be fetched as Markdown by sending Accept: text/markdown.
Only if it contains no external links. Posts that link elsewhere are served with noindex and are absent from the sitemap, and every external link carries rel="nofollow ugc". This makes the service worthless for SEO spam, which is the point.
Every post has a report link. Reports are reviewed and posts can be removed by the operator without the key; the address is then blocked so the content cannot reappear at the same URL.