NFSMW Online: Need for Speed Most Wanted in a browser tab, read from outside the login

Earlier this month I took apart GTA V running in a browser tab: Rockstar's own engine, recompiled to 64-bit WebAssembly, with Direct3D 11 replayed on WebGPU and 20.9 GB of game files streamed in 4 KB blocks. This is its sibling. nfsmwonline.com runs Need for Speed: Most Wanted, EA Black Box's 2005 racer, in Chrome and Edge. It has accounts, a career and saves per account, online Free Roam, one-on-one canyon duels, and things the 2005 game never had: a first-person cockpit with the driver's hands on the wheel, working mirrors, a livery editor holding all 661 of NFS Carbon's vinyls, and horns the other players hear.

The GTA V teardown worked because that site served everything to anyone who opened it. This one does not. Open the root and you get 303 See Other to /login. Ask for robots.txt and you get 401 with the body log in first. The engine, the game files and the netcode only load after you make an account, and I did not make one. I did not log in, submit a form, or download a game file.

So this piece is narrower, and it says so throughout. What I can read is what a logged-out visitor's browser receives, what DNS and certificate logs say about the hosting, and the project's own changelog: nine dated update posts on the log-in page, 96 bullet points between 20 and 22 October 2026, with 23 screenshots. A changelog written for players turns out to say a lot about architecture, if you read it the way you would read a commit log. Every claim below is labelled measured (I observed it in a served file, a header or a lookup), reported (the project says so in its notes) or reasoned (my inference from the other two).

One thing first. Need for Speed: Most Wanted belongs to Electronic Arts. The site's footer says it is "a fan-made project" that "is not affiliated with, endorsed by or sponsored by Electronic Arts Inc." I found no statement from EA about it either way. More on that near the end.

What loads before you can drive

I loaded the root in headless Chromium, three times at a desktop size (1280x860) and three times at a phone size (390x844), and recorded every request. The answer is the same in all six runs (measured): five requests, 482,704 bytes of body.

No external JavaScript file, no .wasm, no service worker, no web app manifest, no fetch, no WebSocket. The HTML carries its CSS and one inline script of 48 lines. Open every update post and scroll to the end and the page pulls the other screenshots lazily: 23 in all, 3,358,664 bytes, 1280x720 JPEGs except one 1280x173 banner. That is the entire logged-out surface.

The inline script is short and mostly UI: it flips the form between "Log in" and "Create account", disables the button after one press, and points forgotten passwords at a Discord channel. Its last three lines are the only technical claim on the page:

if (!navigator.gpu) {
  document.getElementById('err').textContent = 'This browser has no WebGPU - open the game in Chrome or Edge.';
}

So the renderer is WebGPU (measured, in the sense that the page refuses to proceed without it). The notes fill in the rest (reported): when a start fails, "the page now tells you why when it can (no graphics driver, Brave, Chrome on Linux, Firefox outside Windows)", and "where your browser has an older graphics mode, it offers to try that". That list matches where WebGPU has been slowest to arrive on by default, which suggests it came from real failure reports (reasoned). The "older graphics mode" is probably WebGL 2, but the page that offers it is behind the wall.

The log-in page is also not cross-origin isolated (crossOriginIsolated is false, SharedArrayBuffer is undefined, measured). That says nothing about the game page, which has to send its own Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers if the engine uses threads, as GTA V's did. I could not see those headers.

The comments in the script are worth a look for a different reason. One reads, in full: (no invite code box - the user, 2026-10-20: "remove the optional invite code box from our website"; a name and a password make an account). Comments that quote an instruction from "the user", with a date, are how coding agents tend to annotate the changes they make. The project has not said how it writes its code, so take that as an observation about one comment, not a conclusion (measured comment, reasoned reading).

The hosting, from DNS and certificates

Three public lookups fill in the infrastructure (measured):

• nfsmwonline.com, www and nfs.nfsmwonline.com resolve to one address in an IONOS range, served by nginx/1.24.0 (Ubuntu). Static files under /nfs-update/ come straight from nginx (its ETag format, a 403 on the folder index, a plain 404 page); everything else goes through an application that answers 401 log in first for any path it does not know.
• files.nfsmwonline.com sits behind Cloudflare, and a request for a path that does not exist returns the 404 page of a Cloudflare R2 public bucket ("Object not found … Is this your bucket?"). Responses carry a custom x-nfs-mix: 1 header. This is the "fast download network" from the 22 October notes: "the game's files now come from a fast download network … If it can't be reached, the game loads from our server instead" (reported). R2 charges nothing for egress, which matters to a free game whose page says Patreon "helps cover the server costs" (reasoned). I did not guess file names in the bucket.
• The first Let's Encrypt certificates for the domain were issued on 7 October 2026 (crt.sh). The Discord server's ID decodes to a creation time of 7 October 2026, 15:03 UTC, and logo.png was last modified at 21:48 UTC that day. As a public project, NFSMW Online is about 16 days old (reasoned from the three dates).

Its public Discord invite reports about 19,865 members, about 1,240 of them online, and the "Virulent Industries" Roblox community linked from the page, described as "Your Local Game Devs.", has 82 members (measured, 23 October). The Roblox link is a community, not an engine. The screenshots show Most Wanted's own HUD, fonts and menu art, which a Roblox experience would not produce (reasoned).

expand

What it takes to put a 2005 Windows game in a tab

Most Wanted shipped in November 2005 as a 32-bit Windows program that draws with Direct3D 9. A browser offers none of what it expects: no x86 machine code, no Direct3D, no Win32 file API, no threads that block freely, no raw sockets. There are four ways across, and each pays for a different part of that gap.

1. Recompile the original source. Compile the studio's C++ to WebAssembly with Emscripten, then write the layers the platform is missing. This is what the GTA V port did, and its hard parts were the ones you would expect: a fake Direct3D 11 device whose calls are replayed on WebGPU, a file system made of HTTP range requests, and engine threads that block on shared memory while small workers do the asynchronous browser work. It needs the source. GTA V's was available because it leaked from Rockstar.
2. Recompile decompiled source. Reconstruct C++ from the binary function by function, then port that. In the browser, a WebAssembly build of reVC, the community reconstruction of GTA Vice City, is the well-known example, and Take-Two's brand-protection firm filed a DMCA notice against it within days, in December 2025.
3. Run the shipped binary. Translate x86 to WebAssembly at run time and Direct3D 9 calls to WebGL or WebGPU, with the Windows API emulated around it. You need nothing but the .exe, and you pay for it in speed and memory on every frame, and you cannot change much of the game.
4. Write a new engine that reads the original data. OpenMW does this for Morrowind. You own every line, so adding features is easy, but every behaviour of the original has to be rebuilt by hand, and players notice each one you miss.

For a game of this age, some things get easier on every path. A 32-bit game's pointers already fit WebAssembly's default 32-bit memory, where GTA V needed wasm64 (reasoned). Direct3D 9's fixed-function pipeline and shader model 2 and 3 shaders are a small target compared to D3D11 (reasoned). The hard parts that remain are the renderer translation, a file system that is really a network, a frame loop the browser schedules instead of the game, input that reaches the game through DOM events and pointer lock, and memory: a phone tab dies at far less than a desktop has. On top of all that, a single-player game has to grow netcode it never had.

Reading the changelog as a commit log

The notes are written for players, but they leak engineering. Here is what they say, grouped by layer. All of it is reported unless marked.

Renderer and GPU memory. "Firefox now starts in lite mode (its full game ran out of graphics memory), and any browser that runs out of memory in the full game switches to lite on its next start." "iPhone and iPad always play the lite game now - the full game never got going on them." On phones, other players' cars "now load at lighter textures". The cockpit mirrors are "not on phones or in lite mode": a mirror means rendering the scene a second time from behind the car, which is exactly the sort of cost a lite mode cuts (reasoned). "The picture and the HUD are drawn in one go while you drive" on phones reads as merging two render passes into one. There are also plain renderer fixes: the sun's flare "no longer shines through buildings", far mountains "fade into the blue of the sky behind them", and a new sky with its own colour filter options.

Downloads and caching. Phones start "with about 200 MB less memory and, in lite mode, downloads about 90 MB less - and almost nothing the next time". "Almost nothing the next time" means a persistent client-side cache of game files, and a crash fix for "a game file cut short in the browser's cache" confirms it exists and that it once stored a truncated file. Whether it is the Cache API, IndexedDB or the Origin Private File System, as with GTA V, I could not see.

Platforms. There is an Android app with its own bugs (older Mali GPU drivers rendering menus "almost black", a Samsung crash "when a cutscene played", after which "that phone switches to another way of playing the films"). Driver-specific bugs mean the app renders on the phone's own GPU (reasoned). Most posts end "PC: all of this is on PC too", and it is not clear from the notes whether "PC" means a desktop browser or a separate PC build.

Online. Free Roam lobbies, with up to 10 other players on the world map and a supporter tier offering "your own private Free Roam lobby for up to 16" (from a screenshot of the in-game news). Online races keep going when a player leaves, and "if the race's host leaves, the next player takes the race over", so races are hosted by one player's client with host migration rather than run on the server (reasoned). There is text chat, voice (a "Mute Player" turns off "that player's voice"), horns "the other players hear", Ranked ratings, a Top 15 board, and duels that count a dropout as a loss. Other players' cars stream in "nearest first", with "a similar car until theirs is ready". A Discord bot called Razor resets passwords, posts live lobby counts and grants supporter perks once Patreon assigns a Discord role.

Server-side state. "Each account has its own career and saves." "Skipping the prologue no longer gets you flagged by the anti-cheat." A server that flags an impossible career jump is checking progress against rules, not just storing a file (reasoned).

expand

The tell: putting the original game back

The most telling lines are not the new features. They are the fixes that say "like the original game":

• "Police: cops now find their way like in the original game. They drive the game's own road map lane by lane, and follow you through alleys, car parks and short cuts instead of going round."
• "Milestones now count like the original game: every pursuit counts toward ALL of your current rival's milestones at once."
• "Excessive Speeding now starts at 130 km/h, as in the original."
• "Police chases now start like the original game: when the cops come after you, time slows and the camera swings round your car."
• "Drag races now use the original game's drag HUD", and "The milestone board from the original HUD".

If the game's own logic were running, none of these could regress. The police would already route on the road graph and the speeding threshold would already be 130 km/h. A fix worded "now like the original" means that behaviour was missing or written differently, and someone is putting it back by comparing against the real game (reasoned). That is what path 4 produces, and what path 2 produces when the decompilation has holes filled with new code. It is close to the opposite of what running the shipped binary produces.

The second tell is Carbon. Head to Head is "one-on-one Canyon Duels in Carbon's canyons", going over the edge "plays a slow-motion crash shot like in Carbon", and the livery editor carries "all 661 of NFS Carbon's vinyls". Carbon (2006) came from the same studio a year later and shares much of Most Wanted's code and formats: one community plugin SDK, NFSPluginSDK, reverses the types of both games side by side. If you own the loader, moving Carbon's content across is a data job. If all you have is the binary, it is machine-code surgery (reasoned). The supporter car in the news screenshot is a Porsche 911 GT2 RS, a model from more than a decade after the game, so new car content is being added too (measured from the screenshot).

expand

Put the evidence side by side and the shipped-binary path strains on almost every row, the original-source path strains on the regressions, and the two that fit are a decompilation with new code in its gaps or a new engine around the original data. I cannot separate those two from outside, and I would not trust anyone who claims to without seeing the code.

The same table, for readers without the widget:

The decompilation next door

There is a real, public reconstruction of this game's code. dbalatoni13/nfsmw is "a work-in-progress decompilation of the GameCube, Xbox 360, PS2 and PC versions of Need for Speed: Most Wanted". It is a matching decompilation: the C++ must compile back to byte-identical machine code, it targets PC version 1.3 among others, and it contains no game assets. On 23 October, decomp.dev reported 13.94% of the PC build's code matched, 7,012 of 54,366 functions, with the last commit on 10 October (measured). Its README also says plainly that "No feature or porting work is to be done until we have a near-perfect matching base", and that any ports will come from its own organisation.

So the public decompilation is far from able to run the game (reasoned: in a matching decompilation at 14%, most of the game is still the original machine code). Nothing public connects it to NFSMW Online, and I am not suggesting one. If NFSMW Online is built on reconstructed code, it is code that is not public. For the older ecosystem, NFSPluginSDK estimates its coverage of Most Wanted's internal types at about 60% and powers mods that inject into the PC game, which is the usual way Most Wanted has been modified for years.

expand

Who pays, and who owns it

The game is free to play, and the page says so twice. Patreon is "Optional - helps cover the server costs", and the in-game supporters page ends "PERKS ARE THANK-YOUS - THE GAME STAYS FREE". The perks are cosmetic and social: animated name plates, a name on a billboard in Rockport, early test builds, a private Free Roam lobby, and at the top tier a car at the car lot.

expand

Neutrally, then. EA owns Need for Speed: Most Wanted, its code and its data. To be playable without the player supplying a copy, the site must serve the game's assets to every account, and its own notes say "the game's files now come from a fast download network". I found no EA licence, permission or statement about the site, and the site claims none: its footer disclaims any affiliation. The project takes money for perks while it runs, and says that money covers servers. How a rights holder treats that is its call. The nearest precedents are on this site already: Take-Two's DMCA against the reVC browser build, and its cease-and-desist to a Switch port of GTA V, both covered in the ports that came before. I am describing, not predicting.

What I could not see

Because of the login, I did not observe:

• the game page's HTML, scripts, any WebAssembly module, its size, its toolchain (Emscripten or otherwise), or whether it is wasm32 or wasm64;
• whether the engine uses threads and SharedArrayBuffer, and the COOP/COEP headers that would need;
• the WebGPU feature list it asks for, its shader language path (D3D9 bytecode translated, or new shaders), or the "older graphics mode";
• the names, sizes or format of the game files in the R2 bucket, and how they are cached client-side;
• the network transport for Free Roam, races, chat and voice;
• the Android app.

Each of those would move rows in the table above. A logged-in teardown could settle most of them in an afternoon. I chose not to do one, because it means creating an account on a site that serves EA's game to read the files that are EA's game.

How I checked

• curl against /, /login, robots.txt and about 40 other likely paths, recording status, content type and headers; HEAD requests only for anything that looked like a game file. Nothing outside /login, the icons and /nfs-update/ answered 200.
• Headless Chromium (Playwright), six loads of the root at two viewport sizes, logging every finished request with its status, type and body size, plus one load that opened every update post. No form was touched.
• Certificate transparency (crt.sh), DNS lookups, ARIN RDAP for the origin address, the Cloudflare R2 404 body, the public Discord invite endpoint and the public Roblox groups API.
• The update notes: all nine posts read in full, all 23 screenshots viewed, four of them committed here.
• The decompilation's README and the decomp.dev progress API; NFSPluginSDK's README.

All observations are from 23 October 2026, and a project shipping six update posts in one day will have moved on by the time you read this.