Select a section from the sidebar
View and convert AI agent output files in your browser. Everything runs client-side — your files never leave your machine.
Same content, 5 formats. Measured across speed, size, indexability, and security.
PFM adds just 4.5% overhead for its metadata, index, and structure. JSON's escaping and quoting costs 11.5%.
| Format | Raw | Gzipped | Compression | Overhead |
|---|---|---|---|---|
| TXT | 9,188 B | 3,859 B | 42.0% | baseline |
| CSV | 9,227 B | 3,879 B | 42.0% | +0.4% |
| MD | 9,371 B | 3,992 B | 42.6% | +2.0% |
| PFM | 9,604 B | 4,110 B | 42.8% | +4.5% |
| JSON | 10,244 B | 4,153 B | 40.5% | +11.5% |
PFM's indexed section access is 12–25x faster than every other format. JSON wins full parse via C-optimized json.loads().
| Operation | PFM | JSON | CSV | MD | TXT |
|---|---|---|---|---|---|
| Full file read | 31.5 µs | 27.0 µs | 30.1 µs | 30.6 µs | 41.8 µs |
| File ID (64 bytes) | 20.7 µs | 19.8 µs | 20.8 µs | 15.4 µs | 21.1 µs |
| Full parse | 129.7 µs | 47.2 µs | 106.9 µs | 77.9 µs | 79.1 µs |
| Section access | 4.2 µs | 52.8 µs | 104.9 µs | 70.0 µs | 78.7 µs |
PFM is the only format with a pre-computed byte-offset index. All others require full-file scanning to locate a section.
| Format | Section Index | Access Pattern | Sections Found | Searchable |
|---|---|---|---|---|
| PFM | Yes (byte offsets) | O(1) seek | 10 | grep |
| JSON | No | O(n) scan | 10 | jq |
| CSV | No | O(n) scan | 10 | Partial |
| MD | No | O(n) scan | 10 | grep |
| TXT | No | O(n) scan | 10 | grep |
PFM is the only text format with built-in integrity verification, signing, and encryption. Every other format has zero security features.
| Feature | PFM | JSON | CSV | MD | TXT |
|---|---|---|---|---|---|
| Integrity | SHA-256 | None | None | None | None |
| Tamper Detection | Built-in | None | None | None | None |
| Signing | HMAC-SHA256 | None | None | None | None |
| Encryption | AES-256-GCM | None | None | None | None |
| Provenance | Full metadata | Manual | None | None | None |
Benchmarked with Python 3.13 on macOS. 10,000 iterations per test. Same README content across all 5 formats.
Independent offensive security assessments by Red Team. Full penetration testing, APT simulation, and chaos engineering.
Project: PFM • Date: 2026-02-17 • Scope: Python, JS/TS, Chrome Extension, VS Code Extension, SPA • 4 parallel adversarial agents
| Severity | Found | Fixed | Open |
|---|---|---|---|
| CRITICAL | 5 | 5 | 0 |
| HIGH | 5 | 5 | 0 |
| MEDIUM | 10 | 10 | 0 |
| LOW | 8 | 8 | 0 |
Four Red Team agents conducted parallel offensive assessments across all five PFM implementations. All 28 findings were remediated across 6 debate rounds with full verification. 198 automated tests (143 Python + 55 JS) confirm correctness.
| Severity | Finding | Status |
|---|---|---|
| CRIT | Index offset/length out-of-bounds reads | FIXED |
| CRIT | Unbounded meta field injection (DoS) | FIXED |
| CRIT | No file size limit on reader (OOM) | FIXED |
| CRIT | Path traversal in CLI write commands | FIXED |
| CRIT | Missing checksum = pass (fail-open) | FIXED |
| HIGH | Inline onclick handlers violate CSP nonce | FIXED |
| HIGH | Timing side-channel in checksum comparison | FIXED |
| HIGH | Meta key override via duplicate keys | FIXED |
| HIGH | TOCTOU race in stream recovery | FIXED |
| HIGH | No format version validation in JS parsers | FIXED |
| MED | CRLF injection in cross-platform parsing | FIXED |
| MED | CSV formula injection in converter output | FIXED |
| MED | YAML frontmatter injection in Markdown export | FIXED |
| MED | Session storage quota overflow (Chrome ext) | FIXED |
| MED | Error messages leak internal paths | FIXED |
| Vector | Result |
|---|---|
| Malformed PFM magic line injection | DEFENDED |
| Section name charset bypass | DEFENDED |
| Escape sequence round-trip corruption | DEFENDED |
| Encrypted document oracle attack | DEFENDED |
| HMAC signature replay / forgery | DEFENDED |
| Stream writer crash + corrupt recovery | DEFENDED |
| JSON/CSV converter prototype pollution | DEFENDED |
| Cross-implementation checksum mismatch | DEFENDED |
Zero open CRITICAL or HIGH findings. All 28 findings remediated with verification. Defense-in-depth across all five implementations with HMAC-SHA256 signing, AES-256-GCM encryption, constant-time comparisons, and strict input validation at every trust boundary.
Project: PFM • Date: 2026-02-17 • Debate Rounds: 6 • Final Grade: A+
| Round | Focus | Findings | Fixed |
|---|---|---|---|
| 1–2 | Core parser security + escape system | 12 | 12 |
| 3 | VS Code bugs, dead code, meta limits | 6 | 6 |
| 4 | Stream checksum, Chrome offsets, consistency | 8 | 8 |
| 5 | Version validation, CLI commands, path hardening | 10 | 10 |
| 6 | CSP, timing attacks, CRLF, meta-first-wins | 14 | 14 |
| Scan | Red Team parallel assessment (4 agents) | 18 | 18 |
| Suite | Tests | Status |
|---|---|---|
| Python (pytest) | 143 | ALL PASS |
| JavaScript (node:test) | 55 | ALL PASS |
| Total | 198 | ALL PASS |
6 adversarial debate rounds + full Red Team scan. Zero open vulnerabilities. 198 automated tests. All findings remediated with verification across all five implementations.
Signed: Hacking Summit Certification Board • Date: 2026-02-17
Last updated: February 16, 2026
By using PFM (Pure Fucking Magic) software, libraries, tools, web viewer, or file format specification (collectively, the “Service”), you agree to these Terms of Service. If you do not agree, do not use the Service.
PFM is released under the MIT License. You are free to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to the conditions of the MIT License.
The full license text is included with the source code and governs your use of the software.
PFM provides:
.pfm) for AI agent outputThe PFM web viewer and converter run entirely in your browser. No files are uploaded to any server. All processing happens client-side on your machine.
THE SERVICE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
PFM’s security features (checksums, HMAC signing, AES-256-GCM encryption) are provided as tools. Their correctness depends on proper usage. You are responsible for your own security posture and key management.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
You may use PFM for any lawful purpose. You agree not to:
Contributions to PFM are welcome and governed by the project’s CONTRIBUTING.md guidelines. By submitting a contribution, you agree to license it under the same MIT License as the project.
These terms may be updated from time to time. Changes will be reflected in the “Last updated” date above. Continued use of the Service after changes constitutes acceptance of the new terms.
For questions about these terms, open an issue on the project’s GitHub repository.