Profile code

Any page can be written in HTML, CSS and JavaScript instead of built in the editor. Open your dashboard and choose Code. The preview runs your code exactly the way visitors will see it, and the console shows errors and console.log output.

Your code can make the page look and behave however you like. What it can't do is talk to the network or anything outside the page — so a profile can't become an app backend, a login form or a copy of another site.

Your details: window.ohlow

Your public profile is available as a read-only object:

window.ohlow = {
  username: "yourname",
  displayName: "Your Name",
  avatarUrl: "https://…" | null,
  bio: "…",
  badges: [{ id: "developer", label: "Developer" }]
}

Libraries

Load these from Ohlow (other script sources are blocked):

• three.js (MIT) — /vendor/[email protected]/three.module.js (ES module). 3D. Import as an ES module.
• p5.js (LGPL-2.1) — /vendor/[email protected]/p5.min.js. Creative coding sketches.
• anime.js (MIT) — /vendor/[email protected]/anime.umd.min.js. Animation. Also available as anime.esm.min.js.
• Matter.js (MIT) — /vendor/[email protected]/matter.min.js. 2D physics.
• canvas-confetti (ISC) — /vendor/[email protected]/confetti.browser.js. Confetti.

<script src="/vendor/[email protected]/confetti.browser.js"></script>
<script>confetti();</script>

<script type="module">
  import * as THREE from "/vendor/[email protected]/three.module.js";
</script>

Images, video and embeds

• Your uploads on Ohlow (copy an image's link from Media).
• Images from: i.imgur.com, media.tenor.com, media.giphy.com, i.giphy.com, cdn.discordapp.com, media.discordapp.net, i.scdn.co, is1-ssl.mzstatic.com, avatars.githubusercontent.com, images.unsplash.com.
• Embeds from: www.youtube-nocookie.com, open.spotify.com, w.soundcloud.com, player.vimeo.com, embed.music.apple.com.
• Google Fonts, through a normal stylesheet link.

Links

Links work as usual. Ohlow opens them in a new tab, so your page stays open. Only https:, http: and mailto: links open.

What's blocked, and why

• Network requests (fetch, XMLHttpRequest, WebSockets) — profiles show things; they don't call servers.
• Forms, popups and redirecting the visitor — so no one can be sent elsewhere or asked for a password.
• Cookies and storage — your code runs in a sandbox with its own empty origin, so it can never act as a signed-in visitor.
• eval, WebAssembly and workers — this keeps mining and similar abuse out.

Each of HTML, CSS and JavaScript can be up to 150 KB. Pages that break these rules or the guidelines may be removed.