diff --git a/app.py b/app.py
index 83bbc77..be83b0c 100644
--- a/app.py
+++ b/app.py
@@ -619,8 +619,11 @@ def get_system_info():
          background-color: var(--bg); color: var(--text); }}
   h1, h2 {{ color: var(--heading); }}
   .info-section {{ background: var(--section-bg); padding: 1rem; border-radius: 8px; margin: 1rem 0; }}
+  .info-section ul {{ margin: 0.5rem 0 0; padding-left: 1.25rem; }}
+  .info-section li {{ margin: 0.35rem 0; }}
   .config-item {{ margin: 0.5rem 0; }}
-  .value {{ font-family: monospace; background: var(--value-bg); padding: 0.2rem 0.4rem; border-radius: 4px; }}
+  .value, code {{ font-family: monospace; background: var(--value-bg); padding: 0.2rem 0.4rem; border-radius: 4px; }}
+  code {{ padding: 0.1rem 0.35rem; font-size: 0.9em; }}
   .back-link {{ display: inline-block; margin-top: 1rem; padding: 0.5rem 1rem;
                 background: #000; color: #fff; text-decoration: none; border-radius: 8px; }}
   .back-link:hover {{ background: #333; }}
@@ -648,12 +651,30 @@ def get_system_info():
     <ul>
       <li>real-time WebSocket collaboration with cursor preservation across remote edits</li>
       <li>per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI</li>
+      <li><code>?pw=…</code> on a pad URL locks it with that password if it is not protected yet,
+          and unlocks it if it is — so <code>/{{pad_id}}/?pw=s3cret</code> is a one-step create-and-lock link</li>
       <li>line numbers; Tab inserts 4 spaces</li>
       <li>dark / light mode (auto-detects system preference, manual toggle)</li>
       <li>copy-to-clipboard and "new pad" buttons, live peer count in the header</li>
     </ul>
   </div>
 
+  <div class="info-section">
+    <h2>Endpoints</h2>
+    <ul>
+      <li>custom pad path <code>{{pad_id}}</code> (1–64 chars, <code>[a-zA-Z0-9_-]</code>);
+          auto-generated IDs are 8-char <code>[a-z0-9]</code></li>
+      <li><code>POST /</code> — create a pad from the request body (curl-friendly)</li>
+      <li><code>GET /{{pad_id}}/</code> — editor page
+          (<code>?pw=…</code> sets the password on an unprotected pad, unlocks a protected one)</li>
+      <li><code>GET /{{pad_id}}/raw</code> — raw text (auth via <code>?pw=…</code> for protected pads)</li>
+      <li><code>GET /system/info</code> — this page</li>
+      <li><code>GET /health</code> — JSON health check (200 <code>ok</code> / 503 <code>degraded</code>)</li>
+      <li><code>GET /system/metrics</code> — Prometheus metrics, disabled by default</li>
+      <li>WebSocket <code>/ws/{{pad_id}}</code> — live collaboration</li>
+    </ul>
+  </div>
+
   <div class="info-section">
     <h2>Configuration</h2>
     <div class="config-item">