digibeet.nl

Issue someone an "officially recognised digibeet" certificate.

You enter the name of the digibeet, your own name and the certificate language (Dutch or English). The site creates an unguessable link such as https://www.digibeet.nl/c/8yy2nrnyjcq7 that you send yourself — by mail, Signal, whatever. The recipient opens it and sees a printable certificate.

Features

• Dutch by default, English via the flag in the top corner.
• Live preview of the certificate while filling in the form, watermarked "VOORBEELD"/"PREVIEW". Runs in the browser only: nothing is stored or counted.
• Member numbers ("Lid nr. 5") that only ever go up and are never reused, not even after deletion or expiry. The URL keeps a random code, so numbers cannot be used to enumerate other people's certificates.
• Typo correction for 30 minutes after issuing. The secret edit key travels in the URL fragment (#k=...), which browsers never send to a server, and app.js removes it from the address bar immediately. The shared link therefore never carries edit rights.
• Membership counter on the home page: all-time total and the last 30 days.
• About page with contact details; the address is assembled by JavaScript so simple harvesters do not find it.

Properties

• Zero dependencies: Python 3 standard library only (sqlite3, http.server).
• Never sends e-mail — the creator shares the link, so the service cannot be used as a spam relay. The "open in mail program" button is a plain mailto: link handled by the creator's own mail client.
• Retention: every certificate is deleted after 182 days (hourly purge, plus expired rows are never served). secure_delete overwrites deleted data.
• Privacy: no cookies, no trackers, no third-party fonts/scripts, no IP addresses stored or logged. Certificates are noindex and not listed anywhere.
• Self-service removal: anyone holding the link can delete the certificate.

Abuse protection

Layer	What it does
nginx	4 KB body limit, 10 POST/min per IP, 5 GET/s per IP, 20 connections per IP
Form token	HMAC-signed, valid 3 s – 2 h after page load, single use
Honeypot	Hidden field; bots that fill it get a redirect and nothing is stored
Per-client limit	5 certificates / 10 min and 20 / day per IPv4 address or IPv6 /64
Global limit	120 / hour and 1000 / day for the whole site
Hard cap	50 000 stored certificates maximum
Name filter	2–50 chars; letters, spaces, . ' - only; no digits, @, URLs, domain-like text, or long repeated characters
Output	Everything HTML-escaped; strict Content-Security-Policy (no inline scripts)

All tunables are at the top of digibeet.py.

License: GPL-2.0-or-later