Hack Any Webapp

Hack Any Webapp, in plain English

It is a browser add-on that rewrites a website's code on your own computer, so the paywalls and usage limits that site enforces stop applying to you, and it repairs itself whenever the site changes.

That is the whole idea. The rest of this page explains how, with no code and no jargon. If you want the engineering, every section links out to the full writeup.

What it actually does

Almost every app you use in a browser is really one big file of code. The site sends that file to your machine, and your browser runs it. That same file is where the site decides whether you have paid, or whether you have used up your free tries for the day. Because the decision runs on your computer, it can be changed on your computer.

1
You open the site like normal.
No second app, no separate login. The page looks exactly as it always has.
2
The add-on catches the code before it runs.
It quietly intercepts that one big code file on its way into the page.
3
It swaps in a copy with the locks switched off.
A version prepared ahead of time, where the paywall and limit checks are flipped to 'allowed.'
4
The page runs that copy instead.
The site behaves as if you are a paying user, and nothing on screen hints that anything changed.

Why it keeps working

Sites rewrite their own code constantly, sometimes more than once a week. A normal hack would work today and break tomorrow morning. This one does not, because a second piece is always watching the site and redoing the work before anyone notices.

1234repeats
  1. 1The site ships new code, the way it does most weeks.
  2. 2A small program on a server rechecks the site within two hours.
  3. 3It works out the fresh set of changes on its own.
  4. 4Your add-on picks them up and keeps working, with no update to install.

The two halves

The reason it is hard to break is that it splits into two parts, and neither one has to be smart and reliable at the same time. The clever, fragile work happens far away on a server. The thing on your device stays dumb on purpose.

Runs on a server
The smart half
Studies the site and works out the exact change to make.
Is allowed to be clever, and to fail loudly when the site shifts.
Rechecks on a schedule and hands down a fresh recipe.
Runs on your device
The simple half
Just swaps the locked code for the prepared copy.
Knows nothing about how the site is built inside.
Keeps doing its one job even as the site keeps changing.

By the numbers

A sense of scale for what is moving around behind that simple swap.

every 2h
the fix is rechecked, automatically
~19 MB
the code file it rewrites on each load
< 1 KB
the real list of changes sent to your browser
2 rules
did the entire job on one real app

Where this has run

This is not a thought experiment. The same approach has run on two real products: Gizmo AI, an AI study app, and Prodigy, a multiplayer math game, where the build was called Play Origin. Both are written up with the actual code and the bugs that came up along the way.

See the case studies →

So what is this, really

It is a written record of a technique, built and documented on the author's own open-source projects. Think of it as a case study and a patent-style writeup, not a product you install from this page. The point is the method: how you change a web app's behavior on the user's machine and keep it working as the vendor fights back.

Read the technical version

The full breakdown starts with how it works, and the core move, the injection trick that makes all of it possible, gets its own page in the onreset trick. For the design trade-off between pulling a finished file and rebuilding it locally, see Model A vs B.

Built and documented by Alexey Fedorov.