CV Werkstatt

The idea

Most CV generators want an account first and money for the download at the end. CV Werkstatt turns that around: enter your details, pick a template, download the PDF. Everything you type stays in the browser — saved in localStorage, backed up as a JSON file you keep yourself and can import again at any time.

You write the content once. Switching templates takes one click, as often as you like: six restrained ones for job portals and conservative industries, plus three loud ones — Neo-Brutalist, Cyberpunk Glow and Y2K Editorial. Font pairing, accent colour, spacing, font size and paper format (A4 or US Letter) are all adjustable.

A real PDF, typeset in the browser

The PDF is not a screenshot of a web page. It is built with @react-pdf/renderer right in the browser, so the text stays selectable and searchable, applicant tracking systems can read it, and links are clickable. The preview re-typesets the document after every change and rasterises it with pdf.js, which is only loaded once it is needed.

The same pipeline runs in Node. That is how the template thumbnails are generated, and a set of test scripts renders empty and extremely long CVs through every template. Names next to the photo and the drop cap in the Y2K layout are fitted using precomputed glyph widths rather than measured at runtime, so the browser and Node produce exactly the same result.

More than a form

• Cover letters per CV, with a letterhead matching the template family — on their own or combined with the CV into a single PDF.
• Quality hints flag too many pages, end dates before start dates, gaps of six months or more, overlong entries and duplicates. One click jumps to the entry in question.
• LinkedIn import: the data export is unpacked as ZIP or CSV right in the browser and turned into a new CV.
• One version per application: duplicate CVs, show or hide sections, undo and redo for every edit to a CV.
• An optional QR code to your profile, a plain-text export for application forms, and the place, date and signature line expected in German-speaking countries.

Security without a server

With no backend there is no database to attack — but imported files and links still end up in a document other people open. So only http(s), mailto and tel links are accepted, mailto addresses cannot inject headers, and photos are only ever embedded, never loaded from another host. The LinkedIn import caps file and total size, rows, cells and the number of ZIP entries. Each of these rules has its own test script that fails on a violation.

Like this portfolio, CV Werkstatt is built statically, ships in German and English, and gets by without cookies or tracking.