Thirteen sections, one job: leave behind something a grieving person can actually use. Work through them in any order — the Overview tells you what is still missing.
Overview — what is outstanding, worst first. Not a completion percentage: a nearly-full binder that names no executor is worse than a sparse one that does.
Survivor checklist — what to do and when, already filled in. It is written for the reader, not for you, and it travels with the packet.
Vital records, People, Legal documents — who you are, who to call, and which papers exist.
Financial accounts, Insurance, Property & assets, Bills & obligations — what comes in, what pays out, and what keeps taking money.
Running the house — the operational knowledge only you hold: how the bills actually get paid, who fixes what, where things are.
Digital estate — where the keys are kept. Never the keys.
Health, Dependents & pets, Final wishes, Messages.
Each section flags its own gaps — a will with no location, a retirement account with no beneficiary, an executor who has never been asked. Binders in the tab strip are separate estates: your own, and a parent's.
This app is opinionated about a handful of things, all of them learned the hard way by other people.
Record where a secret is, never the secret. Fields marked never write it here exist to hold a pointer — which password manager, which drawer, which sealed envelope. A binder holding live credentials gets printed, photocopied and left in a drawer for a decade.
Beneficiary forms beat the will. On retirement accounts, pensions and life policies, whoever is named on the form takes the money regardless of what the will says. An ex-spouse left on a form from a previous decade is the single commonest expensive mistake here.
Naming an executor is not asking them. The People section tracks whether each one has actually agreed. Finding out at the reading is a bad way for everyone to find out.
A copy is not a will. Most jurisdictions need the signed original, and a will nobody can find is treated as a will that was destroyed on purpose. Every document asks where the original is.
Wishes here are not legally binding. Who gets the piano, who raises the children — write it down by all means, but if it matters it belongs in the will, drafted by somebody qualified. This app is a map to your affairs, not an estate plan.
Do not cancel the phone and email first. They are how the security codes arrive for everything else. The checklist says so, in the right place.
Review after life events. A marriage, divorce, birth, death, move or new account can invalidate a document or strand an account. Each record carries its own reviewed date and goes stale on its own schedule.
Estate law is local and this app knows nothing about where you live. Nothing here is legal, tax or financial advice — it is a place to write down what you already know so somebody else can find it.
Everything in the binder is encrypted with AES-256-GCM before it is written to this browser. The key is derived from your passphrase with PBKDF2-HMAC-SHA256, and it exists only in memory while the binder is open.
Two ways in, on purpose
A random data key encrypts the binder, and that key is then wrapped twice — once under your passphrase, once under the recovery code you were shown when you created it. Both open the same binder, independently.
That is the whole design. You seal the recovery code with your will or in a safe deposit box, and whoever needs to open this after you can — without ever learning the passphrase you still use on everything else.
What this does not protect against
A weak passphrase. Encryption does not fix a guessable one. Length beats punctuation.
Malware on this device. Anything reading your keystrokes reads the passphrase.
The survivor packet. That export is deliberately plaintext — it is meant to be read. Treat the file and the printout as sensitive documents.
The binder locks itself after 15 minutes of no typing, and closing the tab locks it. There is no reset and no back door: forget both the passphrase and the recovery code and the data is gone, which is a property of real encryption rather than an oversight.
Everything stays in this browser. There is no account, no server and no network request at any point. The app is a single HTML file.
Export writes an encrypted .pumapack — the sealed binder exactly as stored, openable with the same passphrase or recovery code. ⌘S / Ctrl+S does the same.
Import takes that file back. It is a restore: it replaces the binder in this browser and opens with whatever passphrase — or recovery code — was in force when the backup was made. The same restore is offered on the lock screen itself, which is how a survivor opens the binder on a computer that has never seen it.
Survivor packet produces the readable document — Markdown, print or PDF. It is not encrypted, and fields marked never write it here are stripped from it.
There is no copy anywhere else. Clearing this site's data, opening the app in a private window, switching browsers, or losing this device erases the binder. Export a backup and keep it somewhere your executor can reach.
Clear all local data
Danger zone. This erases the encrypted binder in this browser. It cannot be undone and a recovery code will not bring it back. Export first.
Type DELETE EVERYTHING to confirm:
⌘/Ctrl + S
Export an encrypted backup
⌘/Ctrl + L
Lock the binder now
?
Open this help
Esc
Close the drawer, dialog or menu
Enter
Unlock, from either passphrase field
Right-click the theme button for the accent picker; right-click a binder tab for its own menu.
PumaReaper is a lightweight, portable, offline tool for collecting the documents and information your survivors will need. It is one HTML file, it never talks to a network, and everything you enter is encrypted on your own device.
Estate law is local and personal circumstances vary enormously. Nothing in this app is legal, tax, financial or medical advice, and it is not a substitute for a will drafted by somebody qualified where you live. It is a place to write down what you already know, so that somebody else can find it.
PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.