The web,
made readable.
Made yours.

04 · Library

Not another pile
of forgotten links.

Ratdolt keeps the result, not just the address. One source owns one Library object; a fresh check can confirm it is current or identify a new version without multiplying covers.

Dashboard opens All Materials as the one private big-picture index: bookmark collections, web publications, saved images, private PDFs, standalone notes and source-anchored highlights together. Loading, a genuinely empty shelf, no matches and a recoverable read failure each name a different next action instead of collapsing into one blank screen. One collection retrieves and manually orders its account-backed publication, image and PDF bookmarks as a single private sequence; drag one into another folder or use the matching keyboard form without erasing its unrelated memberships. Folder settings return to the nested Library, while highlight folders and note topics stay separate. Switch between scannable text rows, an equal-footing Grid with owner-safe image previews or semantic covers, and a Tag View that groups the loaded page without flattening multi-tag objects; hide visual labels without losing an exact keyboard-accessible link, and no original website is contacted for a thumbnail. Sort the complete private result before pagination by last update, newest or oldest save, last open or title; identical keys still resolve by stable object identity, while manual collection order and publication-only reading progress keep their own meanings. Filter the five taggable material families with the same private vocabulary, then choose existing tags or create bounded comma-separated names inside the item editor. Every publication, preserved image and PDF also exposes one explicit Edit bookmark destination: display metadata may change, but source readings, bitmap provenance and PDF bytes/digests/research do not. Browser and account PDF names remain independent even after either copy is opened, and permanent removal names exactly which copy survives. An on-device PDF joins its optional account copy by byte digest after the page opens and keeps its memberships and collection IDs in IndexedDB, so a new tag name can enter the private account vocabulary without uploading a device-only file or rewriting an account copy's update time merely because it was opened locally.

Or keep the address before making anything: Save for later records your title, description, author, source type, cover, favourite, archive state, visibility, collections and tags without contacting the site or spending a publication credit. Public, Favorites and Archived are explicit browser-native shelf categories; sharing composes with favorite and archive state instead of replacing them. Remember saving preferences can carry all five organization choices into future first-time saves, while an existing or trashed source keeps its current identity and organization. Reader or Composer fetches it only when you decide to open it.

All tools keeps the web app navigable as that system grows. Choose the visible control beside the signed-in page field—or press ⌘/Ctrl+K in Ratdolt's focused tab—to search 24 fixed first-party destinations: Reader, Composer, bookmarks, previews, Collections, Tags, images, PDFs, notes, portable integrations, Website settings, Highlight Settings, Account, Help and the rest of the product. Before JavaScript is ready, that same stable control falls back to Help instead of becoming a dead button. Website settings indexes theme, highlight actions, the preferred translation pair and focused-tab keys by their exact owner; Highlight Settings also returns directly from both Composer and local-PDF selection bars. Neither surface can inspect another tab or pretend to be browser chrome.

Give that bookmark a private preserved image or an attributed Unsplash cover. Provider photography stays on Unsplash's CDN with its tracking token intact, and photographer credit follows the cover through Library, Instant Preview and every public surface.

Articles, images, video, podcasts, maps, social links and documents stay filterable as what they are—not as whichever extraction mode opened them. Preview can open direct media and bounded Google Maps or OpenStreetMap views only after a deliberate click; browsing the shelf never contacts those providers or asks Ratdolt's server for your location.

Reader now makes the progress line real. After you remain on a page, Ratdolt saves only the furthest five-decimal fraction and last-opened time for your private active publication, then resumes that exact folio in Spread, Continuous or Focus when you return. Page text, every scroll event, Grid overviews, Browser Print and anonymous readings never become a reading-history feed.

Bring an existing Pocket or Instapaper export with you. Ratdolt reviews it locally, preserves its useful organization and only spends a publication credit when you choose to open and archive a source.

After a separate opt-in, a deliberate @Ratdolt save reply or DM can add one private, unfetched bookmark. The signed command is discarded after its URL is mapped, and opening it remains your choice. A save thread item can then become a bounded, same-author, source-linked edition instead of a screenshot of X.

A PDF stays on its device by default. Download its exact retained bytes from the local shelf or open workspace without flattening, rewriting or attaching research—or create a clearly named second PDF whose visible highlight rectangles are embedded in the pages. Labels and notes remain editable in separate Markdown/JSON, and JSON can return only to the exact SHA-256 document without replacing a same-ID local annotation. Chromium, Firefox and WebKit each reopen the same 12-page PDF and research in a new tab after the production server stops, reproduce byte-identical source bytes and generate the valid 12-page annotated copy again offline. The same three-engine contract rejects an incorrect AES-256 password, clears it, never sends or stores the correct one, asks again on reopen and unlocks the encrypted PDF plus its annotation even after the server is gone. One separate explicit action can preserve a private account copy with expiring links and revision-guarded annotations for another browser.

Archive tidies the shelf. Trash is a separate reversible privacy boundary: it accepts no new permanent copies, revokes active shares and must precede permanent deletion.

Each web version can also leave as one scriptless, dependency-free HTML file capped at 70 MB. When the acquired document still contains the source surface, Ratdolt keeps its static CSS, fonts and guarded images inline; a browser-semantic capture falls back honestly to the measured Ratdolt reading edition. If some guarded resources fail, the partial file remains available while a private seven-day recovery queue tries to improve it.

Keep any selected edition in this browser's offline shelf, then reopen it with the network gone or carry the same one-file HTML into another browser. Chromium, Firefox and WebKit each reopen the inert article from exact local bytes and download the unchanged HTML after the production server stops. A separate local-only PDF shell warms PDF.js, its dynamic chunks and worker plus the local annotated-export runtime, so PDFs already stored here retain search, navigation, encrypted opening, annotations, browser speech and flattened highlight copies offline. It shows the browser's origin-wide usage, quota and eviction class; integrity checks hide missing-byte ghosts, recover or deliberately discard unindexed bytes, remove stale labels without erasing research, and let you export research-only JSON before confirmed removal or exact-file recovery. These public shells cache no session, API response, private Library page or publication body: every device copy enters IndexedDB only when you choose, and deleting it never deletes the account edition or a downloaded backup.

Share one collection without publishing your profile: a revocable, unlisted link preserves its owner order across web bookmarks, verified saved images and download-only account PDFs. Ratdolt stores only the link digest; snapshots, PDF workspaces, highlights, notes, private covers, account IDs and the collaborator roster stay behind the grant. Rotation, disabling or removing a file closes its old access path.

Public collection pages keep useful folder navigation without inheriting visibility: a parent breadcrumb and direct-child cards appear only when each folder and the profile are independently public. A public child beneath a private parent becomes a public root, so the hidden parent's name and slug never leak.

An account-backed image or PDF can also become a public bookmark, but only after three separate choices agree: the file, at least one containing collection and the owner profile must each be public. Ratdolt serves the verified bytes from an opaque first-party address, forces a public PDF to download and never publishes its annotation workspace. Removing every public collection gate stops delivery; withdrawing the file also rotates its former address. The public collection page and its portable embed preserve one mixed owner order, while the public profile and profile embed show each eligible web, image or PDF bookmark once in global update order.

Your public identity is equally deliberate. Account keeps display name, biography, location, website and named social destinations together; LinkedIn, X/Twitter and GitHub labels cannot disguise another host. A complete birthday stays private unless you separately publish month and day, never the year. Preview a verified avatar and uploaded cover from local browser bytes before saving, or choose an Unsplash cover that remains on its provider CDN with visible credit. The no-account tour exposes the complete editor without writing a profile, contacting Unsplash or leaking its experimental values into the public demo.

Account access stays self-service in the browser: change a route-safe username, confirm email changes, verify the current password before replacement, recover access and connect or remove Google or X while one usable password or social method remains. Permanent account deletion waits until billing is clear, then removes account-stored profile media, images, cloud PDFs—including interrupted uploads—and permanent copies before deleting the owner. Device-only PDFs and offline copies remain under that browser profile's separate control.

Reading Commons searches the whole current public projection—not just its newest shelf—and continues through stable pages of doubly opted-in profiles, readings and collections. Save one as a private, unfetched bookmark—or copy up to 100 public collection members—without inheriting another reader’s snapshots or research.