Sixpence

Finance apps want a bank login before they will show you anything, and the mid-month figure they show you is usually flattering: a running total this month set against a finished one last month, which always reads as progress. The honest alternative, a spreadsheet, tells you what you spent and never whether you are on pace to overspend.

Everything is entered by hand, so there is no bank connection to trust and nothing to leak. PHP 8 with no framework and no Composer dependencies, one entry point, prepared statements throughout, per-session CSRF tokens on every form, and five failed sign-ins locking an account for fifteen minutes. Budgets are pace-aware: they answer what is left per day rather than what is left in total, and month-to-date is compared against the same point last month rather than the whole of it. The PDF exporter and the SMTP client are written from scratch for the same reason as the rest, which is that there is then no dependency to audit. The interface works with JavaScript switched off.

1. 1Every request enters through one file, public/index.php
2. 2The router resolves a clean URL to a single page handler
3. 3Session, CSRF token and ownership checked before any write
4. 4Post, redirect, get, so a refresh never posts twice
5. 5Schema migrations run on the first database connection

Deployed and open to sign up for, with twelve display currencies, CSV and PDF export, and email and in-app alerts. A 68-test suite covers the money arithmetic, recurrence, migrations and the security properties, and runs against PHP 8.1 through 8.4 and PostgreSQL 16 on every push.

PHP 8, PostgreSQL, Chart.js, Docker