NFSMW Online: Need for Speed Most Wanted in a browser tab, read from outside the login

Earlier this month I took apart GTA V running in a browser tab: Rockstar's own engine, recompiled to 64-bit WebAssembly, with Direct3D 11 replayed on WebGPU and 20.9 GB of game files streamed in 4 KB blocks. This is its sibling. nfsmwonline.com runs Need for Speed: Most Wanted, EA Black Box's 2005 racer, in Chrome and Edge. It has accounts, a career and saves per account, online Free Roam, one-on-one canyon duels, and things the 2005 game never had: a first-person cockpit with the driver's hands on the wheel, working mirrors, a livery editor holding all 661 of NFS Carbon's vinyls, and horns the other players hear.

The GTA V teardown worked because that site served everything to anyone who opened it. This one does not. Open the root and you get 303 See Other to /login. Ask for robots.txt and you get 401 with the body log in first. The engine, the game files and the netcode only load after you make an account, and for most of this piece I did not make one. I did not log in, submit a form, or download a game file. Later the same day, with Satyajit's go-ahead, I made one account and looked: that is the section behind the login, and it corrects several of the guesses below, each one by name.

So this piece is narrower, and it says so throughout. What I can read is what a logged-out visitor's browser receives, what DNS and certificate logs say about the hosting, and the project's own changelog: nine dated update posts on the log-in page, 96 bullet points between 20 and 22 October 2026, with 23 screenshots. A changelog written for players turns out to say a lot about architecture, if you read it the way you would read a commit log. Every claim below is labelled measured (I observed it in a served file, a header or a lookup), reported (the project says so in its notes) or reasoned (my inference from the other two).

One thing first. Need for Speed: Most Wanted belongs to Electronic Arts. The site's footer says it is "a fan-made project" that "is not affiliated with, endorsed by or sponsored by Electronic Arts Inc." I found no statement from EA about it either way. More on that near the end.

What loads before you can drive

I loaded the root in headless Chromium, three times at a desktop size (1280x860) and three times at a phone size (390x844), and recorded every request. The answer is the same in all six runs (measured): five requests, 482,704 bytes of body.

No external JavaScript file, no .wasm, no service worker, no web app manifest, no fetch, no WebSocket. The HTML carries its CSS and one inline script of 48 lines. Open every update post and scroll to the end and the page pulls the other screenshots lazily: 23 in all, 3,358,664 bytes, 1280x720 JPEGs except one 1280x173 banner. That is the entire logged-out surface.

The inline script is short and mostly UI: it flips the form between "Log in" and "Create account", disables the button after one press, and points forgotten passwords at a Discord channel. Its last three lines are the only technical claim on the page:

if (!navigator.gpu) {
  document.getElementById('err').textContent = 'This browser has no WebGPU - open the game in Chrome or Edge.';
}

So the renderer is WebGPU (measured, in the sense that the page refuses to proceed without it). The notes fill in the rest (reported): when a start fails, "the page now tells you why when it can (no graphics driver, Brave, Chrome on Linux, Firefox outside Windows)", and "where your browser has an older graphics mode, it offers to try that". That list matches where WebGPU has been slowest to arrive on by default, which suggests it came from real failure reports (reasoned). The "older graphics mode" is probably WebGL 2, but the page that offers it is behind the wall.

The log-in page is also not cross-origin isolated (crossOriginIsolated is false, SharedArrayBuffer is undefined, measured). That says nothing about the game page, which has to send its own Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers if the engine uses threads, as GTA V's did. I could not see those headers.

The comments in the script are worth a look for a different reason. One reads, in full: (no invite code box - the user, 2026-10-20: "remove the optional invite code box from our website"; a name and a password make an account). Comments that quote an instruction from "the user", with a date, are how coding agents tend to annotate the changes they make. The project has not said how it writes its code, so take that as an observation about one comment, not a conclusion (measured comment, reasoned reading).

The hosting, from DNS and certificates

Three public lookups fill in the infrastructure (measured):

• nfsmwonline.com, www and nfs.nfsmwonline.com resolve to one address in an IONOS range, served by nginx/1.24.0 (Ubuntu). Static files under /nfs-update/ come straight from nginx (its ETag format, a 403 on the folder index, a plain 404 page); everything else goes through an application that answers 401 log in first for any path it does not know.
• files.nfsmwonline.com sits behind Cloudflare, and a request for a path that does not exist returns the 404 page of a Cloudflare R2 public bucket ("Object not found … Is this your bucket?"). Responses carry a custom x-nfs-mix: 1 header. This is the "fast download network" from the 22 October notes: "the game's files now come from a fast download network … If it can't be reached, the game loads from our server instead" (reported). R2 charges nothing for egress, which matters to a free game whose page says Patreon "helps cover the server costs" (reasoned). I did not guess file names in the bucket.
• The first Let's Encrypt certificates for the domain were issued on 7 October 2026 (crt.sh). The Discord server's ID decodes to a creation time of 7 October 2026, 15:03 UTC, and logo.png was last modified at 21:48 UTC that day. As a public project, NFSMW Online is about 16 days old (reasoned from the three dates).

Its public Discord invite reports about 19,865 members, about 1,240 of them online, and the "Virulent Industries" Roblox community linked from the page, described as "Your Local Game Devs.", has 82 members (measured, 23 October). The Roblox link is a community, not an engine. The screenshots show Most Wanted's own HUD, fonts and menu art, which a Roblox experience would not produce (reasoned).

expand

What it takes to put a 2005 Windows game in a tab

Most Wanted shipped in November 2005 as a 32-bit Windows program that draws with Direct3D 9. A browser offers none of what it expects: no x86 machine code, no Direct3D, no Win32 file API, no threads that block freely, no raw sockets. There are four ways across, and each pays for a different part of that gap.

1. Recompile the original source. Compile the studio's C++ to WebAssembly with Emscripten, then write the layers the platform is missing. This is what the GTA V port did, and its hard parts were the ones you would expect: a fake Direct3D 11 device whose calls are replayed on WebGPU, a file system made of HTTP range requests, and engine threads that block on shared memory while small workers do the asynchronous browser work. It needs the source. GTA V's was available because it leaked from Rockstar.
2. Recompile decompiled source. Reconstruct C++ from the binary function by function, then port that. In the browser, a WebAssembly build of reVC, the community reconstruction of GTA Vice City, is the well-known example, and Take-Two's brand-protection firm filed a DMCA notice against it within days, in December 2025.
3. Run the shipped binary. Translate x86 to WebAssembly at run time and Direct3D 9 calls to WebGL or WebGPU, with the Windows API emulated around it. You need nothing but the .exe, and you pay for it in speed and memory on every frame, and you cannot change much of the game.
4. Write a new engine that reads the original data. OpenMW does this for Morrowind. You own every line, so adding features is easy, but every behaviour of the original has to be rebuilt by hand, and players notice each one you miss.

For a game of this age, some things get easier on every path. A 32-bit game's pointers already fit WebAssembly's default 32-bit memory, where GTA V needed wasm64 (reasoned). Direct3D 9's fixed-function pipeline and shader model 2 and 3 shaders are a small target compared to D3D11 (reasoned). The hard parts that remain are the renderer translation, a file system that is really a network, a frame loop the browser schedules instead of the game, input that reaches the game through DOM events and pointer lock, and memory: a phone tab dies at far less than a desktop has. On top of all that, a single-player game has to grow netcode it never had.

Reading the changelog as a commit log

The notes are written for players, but they leak engineering. Here is what they say, grouped by layer. All of it is reported unless marked.

Renderer and GPU memory. "Firefox now starts in lite mode (its full game ran out of graphics memory), and any browser that runs out of memory in the full game switches to lite on its next start." "iPhone and iPad always play the lite game now - the full game never got going on them." On phones, other players' cars "now load at lighter textures". The cockpit mirrors are "not on phones or in lite mode": a mirror means rendering the scene a second time from behind the car, which is exactly the sort of cost a lite mode cuts (reasoned). "The picture and the HUD are drawn in one go while you drive" on phones reads as merging two render passes into one. There are also plain renderer fixes: the sun's flare "no longer shines through buildings", far mountains "fade into the blue of the sky behind them", and a new sky with its own colour filter options.

Downloads and caching. Phones start "with about 200 MB less memory and, in lite mode, downloads about 90 MB less - and almost nothing the next time". "Almost nothing the next time" means a persistent client-side cache of game files, and a crash fix for "a game file cut short in the browser's cache" confirms it exists and that it once stored a truncated file. Whether it is the Cache API, IndexedDB or the Origin Private File System, as with GTA V, I could not see.

Platforms. There is an Android app with its own bugs (older Mali GPU drivers rendering menus "almost black", a Samsung crash "when a cutscene played", after which "that phone switches to another way of playing the films"). Driver-specific bugs mean the app renders on the phone's own GPU (reasoned). Most posts end "PC: all of this is on PC too", and it is not clear from the notes whether "PC" means a desktop browser or a separate PC build.

Online. Free Roam lobbies, with up to 10 other players on the world map and a supporter tier offering "your own private Free Roam lobby for up to 16" (from a screenshot of the in-game news). Online races keep going when a player leaves, and "if the race's host leaves, the next player takes the race over", so races are hosted by one player's client with host migration rather than run on the server (reasoned). There is text chat, voice (a "Mute Player" turns off "that player's voice"), horns "the other players hear", Ranked ratings, a Top 15 board, and duels that count a dropout as a loss. Other players' cars stream in "nearest first", with "a similar car until theirs is ready". A Discord bot called Razor resets passwords, posts live lobby counts and grants supporter perks once Patreon assigns a Discord role.

Server-side state. "Each account has its own career and saves." "Skipping the prologue no longer gets you flagged by the anti-cheat." A server that flags an impossible career jump is checking progress against rules, not just storing a file (reasoned).

expand

The tell: putting the original game back

The most telling lines are not the new features. They are the fixes that say "like the original game":

• "Police: cops now find their way like in the original game. They drive the game's own road map lane by lane, and follow you through alleys, car parks and short cuts instead of going round."
• "Milestones now count like the original game: every pursuit counts toward ALL of your current rival's milestones at once."
• "Excessive Speeding now starts at 130 km/h, as in the original."
• "Police chases now start like the original game: when the cops come after you, time slows and the camera swings round your car."
• "Drag races now use the original game's drag HUD", and "The milestone board from the original HUD".

If the game's own logic were running, none of these could regress. The police would already route on the road graph and the speeding threshold would already be 130 km/h. A fix worded "now like the original" means that behaviour was missing or written differently, and someone is putting it back by comparing against the real game (reasoned). That is what path 4 produces, and what path 2 produces when the decompilation has holes filled with new code. It is close to the opposite of what running the shipped binary produces.

The second tell is Carbon. Head to Head is "one-on-one Canyon Duels in Carbon's canyons", going over the edge "plays a slow-motion crash shot like in Carbon", and the livery editor carries "all 661 of NFS Carbon's vinyls". Carbon (2006) came from the same studio a year later and shares much of Most Wanted's code and formats: one community plugin SDK, NFSPluginSDK, reverses the types of both games side by side. If you own the loader, moving Carbon's content across is a data job. If all you have is the binary, it is machine-code surgery (reasoned). The supporter car in the news screenshot is a Porsche 911 GT2 RS, a model from more than a decade after the game, so new car content is being added too (measured from the screenshot).

expand

Put the evidence side by side and the shipped-binary path strains on almost every row, the original-source path strains on the regressions, and the two that fit are a decompilation with new code in its gaps or a new engine around the original data. I cannot separate those two from outside, and I would not trust anyone who claims to without seeing the code.

The same table, for readers without the widget. The last two rows come from behind the login, later the same day, and they settle what the rows above could not:

The decompilation next door

There is a real, public reconstruction of this game's code. dbalatoni13/nfsmw is "a work-in-progress decompilation of the GameCube, Xbox 360, PS2 and PC versions of Need for Speed: Most Wanted". It is a matching decompilation: the C++ must compile back to byte-identical machine code, it targets PC version 1.3 among others, and it contains no game assets. On 23 October, decomp.dev reported 13.94% of the PC build's code matched, 7,012 of 54,366 functions, with the last commit on 10 October (measured). Its README also says plainly that "No feature or porting work is to be done until we have a near-perfect matching base", and that any ports will come from its own organisation.

So the public decompilation is far from able to run the game (reasoned: in a matching decompilation at 14%, most of the game is still the original machine code). Nothing public connects it to NFSMW Online, and I am not suggesting one. If NFSMW Online is built on reconstructed code, it is code that is not public. For the older ecosystem, NFSPluginSDK estimates its coverage of Most Wanted's internal types at about 60% and powers mods that inject into the PC game, which is the usual way Most Wanted has been modified for years.

expand

Who pays, and who owns it

The game is free to play, and the page says so twice. Patreon is "Optional - helps cover the server costs", and the in-game supporters page ends "PERKS ARE THANK-YOUS - THE GAME STAYS FREE". The perks are cosmetic and social: animated name plates, a name on a billboard in Rockport, early test builds, a private Free Roam lobby, and at the top tier a car at the car lot.

expand

Neutrally, then. EA owns Need for Speed: Most Wanted, its code and its data. To be playable without the player supplying a copy, the site must serve the game's assets to every account, and its own notes say "the game's files now come from a fast download network". I found no EA licence, permission or statement about the site, and the site claims none: its footer disclaims any affiliation. The project takes money for perks while it runs, and says that money covers servers. How a rights holder treats that is its call. The nearest precedents are on this site already: Take-Two's DMCA against the reVC browser build, and its cease-and-desist to a Switch port of GTA V, both covered in the ports that came before. I am describing, not predicting.

What I could not see

Because of the login, I did not observe:

• the game page's HTML, scripts, any WebAssembly module, its size, its toolchain (Emscripten or otherwise), or whether it is wasm32 or wasm64 (now seen: Rust and wasm-bindgen, wasm32);
• whether the engine uses threads and SharedArrayBuffer, and the COOP/COEP headers that would need (now seen: no threads, no such headers);
• the WebGPU feature list it asks for, its shader language path (D3D9 bytecode translated, or new shaders), or the "older graphics mode" (now seen: new WGSL shaders, and WebGPU's compatibility mode);
• the names, sizes or format of the game files in the R2 bucket, and how they are cached client-side (now seen: a 4,008-file manifest and the Cache API);
• the network transport for Free Roam, races, chat and voice (now seen in the code, a WebSocket, though not in use);
• the Android app (still not seen).

Each of those would move rows in the table above. A logged-in teardown could settle most of them in an afternoon. At first I chose not to do one, because it means creating an account on a site that serves EA's game to read the files that are EA's game. Later that day Satyajit asked for it, and the section behind the login is the result.

23 October: nfsmwo.com runs the shipped game

After I wrote the above, Satyajit pointed me at a second site, nfsmwo.com. Same game, same month, a similar name, a different machine underneath. It shows what the shipped-binary path looks like when someone takes it, and nearly all of it is public.

Who runs it. nfsmwo.com is the home of Most Wanted Online (MWO), a multiplayer mod for the PC game. Its Next.js site's footer reads "© 2017-∞ PlakMP.com", the group that also sells the Plak Graphics mod. Its credits name osdever as founder and Dz3n as co-founder (measured, from the page). The domain was registered on 28 December 2024, and the "MWO Reborn" Discord it links was created on 10 September 2020 and reports about 29,456 members (measured). So MWO is an established mod, years older than NFSMW Online (reasoned).

It ships two ways. The PC client goes into your own installation: the page asks for "a clean copy of NFS Most Wanted", version 1.3 and in English, then MostWantedOnline.exe beside speed.exe (reported). The download link resolves to MostWantedOnline.zip, 4,601,773 bytes, a ZIP whose first entry is MostWantedOnline.exe, last modified 17 November 2025 (measured from a HEAD request and its first 64 bytes; I did not download it). The second way is "Play in your browser" at web.nfsmwo.com, and that is the one that matters here.

expand

The browser build runs the original executable under Wine. The page embeds its launch config as JSON. It passes "arguments":["D:\\speed.exe"] and sets WINESYSTEMROOT and WINEDLLOVERRIDES=dinput8,d3d9,d3dx9_26,d3dx9_43=b (measured). The script it loads, mw_web.js (154,269 bytes), is Emscripten output with pthreads, the WasmFS file system with an OPFS backend, dynamic linking, a WebGL 2 context and no WebGPU calls, and it imports Wine's __wine_unix_call_funcs_* tables (measured). The page sends COOP same-origin and COEP require-corp, the isolation threads need (measured). The file listing for its wine folder names 48 DLLs from Wine's i386-windows folder, ntdll to user32, and a d3d9.dll of 3,584 bytes (measured). That is far too small to be Direct3D 9, so it is presumably a stub handing calls to the wasm side, which draws with WebGL 2 (reasoned). The game's x86 code and Wine's x86 DLLs run on a translator inside WebAssembly: path 3 above.

The build manifest says how they pay for the translation. It lists a main module, mw_web.wasm, of 95,956,980 bytes; 3,028 code "shards" totalling 280,661,666 bytes in 66 groups; and a jit block with a 2.5 GiB memory ceiling (measured). My reading is that most guest code is translated ahead of time on their side and served as wasm side modules, with a JIT for the rest (reasoned from the names and the dynamic-linking imports; I could not look inside). The main module ships as 23 parts, 10,617,881 bytes on the wire, under a partCipher of pms-part-1 with sealedCode: true. The first part has no wasm header, and the page script calls WebCrypto's AES-GCM (measured). The engine is encrypted at rest. I did not decrypt it, so the section count, imports and toolchain strings I read for GTA V stay unread here.

expand

It serves the whole game. The listing of the program folder, which the page fetches with no login, names 1,783 files totalling 4,476,030,245 bytes: SOUND at 2.05 GB, MOVIES at 1.17 GB, TRACKS, CARS, and a 6,266,880-byte speed.exe, each with a content-addressed URL on pmscdn.playnfs.com (measured). The FAQ says the first start fetches "about 2 GB" and that "Single player needs no account" (reported). Loaded headless for 20 seconds without a click, the start page made 290 requests and transferred 15,500,356 bytes, 14,707,180 of them from that CDN, mostly 1 MiB chunks of game files (measured). The mods folder holds 31 files, every one marked sealed: community plugins (Widescreen Fix, XenonEffects, Unlimiter, LimitAdjuster, NFSMultiLang) beside MWO's own Pms* plugins and an 11,946,232-byte rosewood-pms.asi (measured). The pack's README credits each mod's authors.

How it relates to nfsmwonline.com. They differ at every layer I could compare: WebGL 2 against WebGPU, Cloudflare against nginx on IONOS, single player without an account against a login for everything. The timing is close. MWO's version file is stamped 8 October 2026, playnfs.com was registered on 10 October, its CDN's first certificate dates from 14 October, and speed.exe on the CDN was last modified on 15 October (measured). NFSMW Online's first certificate is from 7 October. Two browser builds of one game went public within about a week (reasoned). Neither site names the other in anything I fetched (measured), so I read them as rivals rather than a fork, without ruling out more. A third port, dezm0n's on itch.io, has its own article on this site: a static recompilation of the same speed.exe to WebAssembly. It describes itself as "powered by WebAssembly and WebGPU", says "Online/LAN modes are unsupported", and its player entry files contain no PMS, Wine or nfsmwo strings (measured).

What it changes in the table. The shipped-binary column is no longer hypothetical: it is marked in the widget above as where web.nfsmwo.com sits. It also sharpens the contrast. Run the binary and the original police routing and 130 km/h speeding line come free; new features arrive as injected plugins, the DLL route the widget mentions. NFSMW Online's notes, restoring behaviour "like the original game", are the opposite signature (reasoned), and behind its login the reason turned out to be a new engine (measured). One cell softens. MWO runs the binary on phones too and ships pre-built code to cut the cost, so the phone row reads as a cost, not a wall.

Who pays, and who owns it. EA owns the game. The PC client asks players to supply their own copy. The browser build serves EA's executable and data to anyone who opens the page, and I saw no ownership step before Single Player, though I did not press it (measured listing, reasoned reading). The site sells donor perks: premium cars, and in-game coins and currency per dollar. The browser config also names a video-ad provider behind a pms-video-ads flag; whether ads appear, I did not see (measured config). I found no EA statement about MWO and no affiliation disclaimer on either nfsmwo page. I am describing, not predicting.

How I checked nfsmwo.com. I fetched the home page, robots.txt, the three-URL sitemap and its 25 Next.js chunks (sign-up goes through id.nfsmwo.com with hCaptcha). I loaded both pages in headless Chromium at 1280 px, aborting in the browser any request for engine parts, code shards or listings, then fetched as text the manifest, six folder listings, the preload plan and six small config files. The page's own preload still pulled game-file chunks into a throwaway browser profile, deleted when it closed. I read only the first 64 bytes of a wasm part, a code shard, speed.exe and the ZIP. Wine DLL names come from the listing, not the binaries. I also used crt.sh, RDAP and Discord's public invite endpoint. The Wayback Machine did not answer. I created no account and pressed neither play button.

23 October: behind the login

Later the same day Satyajit asked for the other half and agreed to one account, made through the site's own form with a throwaway name and password. I loaded the game page in headless Chromium as that user and recorded every request, as I did for the itch.io port. The page fetched its own code; every game-file transfer over 5 MB I stopped at its response headers. I joined nothing and never got past the loading screen.

The page and the module

The game page is the root. After sign-up, / answers with a 123,409-byte HTML file of 1,970 lines, most of them script (measured). It sends no Cross-Origin-Opener-Policy or Cross-Origin-Embedder-Policy header, so it is not cross-origin isolated and has no SharedArrayBuffer, and it registers no service worker (measured). GTA V, the itch.io port and web.nfsmwo.com all run threads; this one does not.

It loads one module: import init from './pkg/nfs.js'. A pkg/ folder holding nfs.js and nfs_bg.wasm is what wasm-pack writes for a Rust crate built with wasm-bindgen. The glue is 101,311 bytes (15,514 gzipped) and the module 13,687,532 (4,584,640 gzipped) (measured). From my sandbox, with /players reporting 498 to 502 people online, the module took about five minutes to arrive from the origin, while the file host below delivered 41 MB in under a minute (measured, one cloud machine, one morning).

A direct request for the glue, even with my session cookie, gets 403 and "that's the game's - play it at https://nfsmwonline.com" (measured). So I did not fetch the engine myself: I read the copies my browser received while loading the page, then deleted them.

The rest of the page is armour: it wraps WebGPU so that a lost GPU restarts the page instead of freezing the game, and its comments cite "the reports", the anonymous crash reports it posts to /report, 19 times (measured; I blocked those posts). Three details answer questions from outside:

• The "older graphics mode" is WebGPU's compatibility mode, requested as featureLevel: 'compatibility' when the player follows a ?NFS_COMPAT=1 link. It is not WebGL 2, as I guessed above (measured).
• The game-file cache is the Cache API, a store named nfs-files, and the page asks for navigator.storage.persist() (measured). My profile had no Origin Private File System entries and no IndexedDB.
• Devices get tiers by memory, cores and GPU; an iPhone or iPad always gets the lite game, and a comment puts the full game's textures at "1.3 GB" (reported).

The page also turns off right-click and the developer-tools keys, because "the game's files aren't to be taken" (measured). That is a deterrent, not a lock, and I treated it as a request.

expand

A new engine, written in Rust

I parsed the module with a short script of my own (measured throughout this part):

• Size and shape. 13,687,532 bytes of wasm32: a code section of 10,286,858 bytes in 10,413 function bodies, 1,322,192 bytes of data, and one memory of its own, 158 pages to start, unshared. Its target features stop at bulk memory, reference types and the like: no threads, no SIMD.
• Names kept. A 2,036,273-byte name section names 10,841 functions. The itch.io port's module kept none. The producers section reads Rust, rustc 1.98.1 (2026-09-01), wasm-bindgen 0.2.129.
• Whose code. By crate: 2,718 functions in the game's own crate, nfs; 4,573 in Rust's core, alloc and std; 673 in wgpu 0.19.4, the Rust graphics library that becomes WebGPU in a browser; 267 in winit 0.29.15 for the window and input; 521 in the symphonia audio decoders (MP3, AAC, Vorbis, FLAC, WAV, MP4 and Ogg); 38 in gilrs for gamepads.
• Its own source. Panic messages name 87 files under nfs-gpu\src\, in a Windows workspace called nfs-rust: police.rs, police_drive.rs, police_pid.rs, mwai.rs, career.rs, traffic.rs, pursuit_music.rs, speech.rs, duelnet.rs, racenet.rs, raceaudit.rs, voice.rs, vp6.rs, and so on.
• What is missing. No x86 address, no Ghidra-style FUN_ name, no machine code from speed.exe, no Emscripten, and no SDL beyond a gamepad crate's parser for SDL's controller mappings. It is not the itch.io port's kit or build, and not a recompilation of any kind.

How it relates to the 2005 game shows in its strings. An offline converter, nfs-tools, turns the game's files into the engine's own: nfs-tools career <attributes.bin> <gameplay.bin> out/career.txt, the front end's PLATFORMCRIB.BIN, traffic zones, races (measured). The engine then reads only its own formats and refuses anything without their magic numbers ("not an NGP1/NGW1 mesh", NGC1 walls, NGS1, NGR1). Carbon's canyons come the same way, from "the extracted Carbon data" (measured). The 34 fragment and 23 vertex shaders are WGSL written by hand, and their comments say where the numbers came from. The colour filter takes "EA's PC values: tint .88 .80 .44, colour bloom 1.75", and its curves "were fitted to the PC original's own Visual Treatment Low/High screenshots" (measured comments). The original's data and numbers, then, in new code.

The shaders keep the log-in page's comment style too: the sun-flare fix from the 20 October notes quotes "the user, 2026-10-20", one of seven such dated quotes in the module (measured). It fits the earlier reading and still proves nothing about who typed the code (reasoned).

It also explains the changelog: a fix worded "like the original game" is a rewrite catching up with its model, one system at a time (reasoned). The /app page settles the other open question: "PC" means a native Windows build. A 14 MB installer downloads "about 6.8 GB" and needs "DirectX 12 or Vulkan", and the 25 MB Android app downloads "about 3.8 GB" and needs Vulkan (reported). wgpu and winit build natively for both, and the manifest below lists a 25,889,744-byte libgame.so for 64-bit ARM, so the same Rust engine most likely runs everywhere (reasoned).

Where the game comes from

The page fetches /manifest?cdn=1 (256,325 bytes, no-store). It lists every file the client can ask for, 4,008 files and 5,237,314,648 bytes, and its first line is #cdn https://files.nfsmwonline.com (measured):

In game/, SOUND holds 40 files and 911,323,451 bytes, among them MW_Music.mus at 533,877,888 bytes, the byte count the itch.io port's manifest gives for it. Their timestamps decode to October 2005 (measured; the stamps match Last-Modified where I could compare). MOVIES holds the 31 story and tutorial films, 889,233,391 bytes, as MP4 files stamped 6 October 2026. The 2005 game shipped them as VP6. Carbon's canyons are 58 files of 351,350,487 bytes, and the Porsche 911 GT2 RS is 21 files of 93,988,119. speed.exe is not in the manifest (measured).

Each file lives at files.nfsmwonline.com/m/ plus a 16-hex content hash from the manifest, plus its path. Every one of the 624 responses I logged from that host carried Cache-Control: public, max-age=31536000, immutable, Access-Control-Allow-Origin: *, cf-cache-status: DYNAMIC and X-NFS-Mix: 1. Big files come as 32 MiB Range requests, and when the host fails, the origin's /out/…?direct=1 answers 302 to the same address (measured). None of the 410 files whose first bytes I kept starts with its format's magic number, not even a .wav with its RIFF, which with that header reads as scrambled at rest (measured bytes, reasoned reading; I did not try to unscramble anything). The session cookie is host-only on nfsmwonline.com, so the browser does not send it to files.. Access rests on the hashed addresses appearing only in a logged-in manifest (reasoned; I did not test the host without the cookie).

The full game's preload.txt lists 1,381 files, 1,154,679,097 bytes, to load before the first frame. That is the "Loading Rockport" bar in the figure (measured). I let 41 MB of small sounds and sky files through into a throwaway browser profile and aborted 202 responses: every 32 MiB range of the world, and every response that did not declare its size. The loader then retried each aborted file, through the file host and then the origin, so I ended that run at 60 seconds rather than leave it knocking (measured).

Netcode, saves and anti-cheat, from the code

My page never left the loading screen, so it never opened a socket. This is read from the code, not from play:

• One WebSocket. The glue constructs new WebSocket(url) and imports nothing for WebRTC or WebTransport. The module builds its address from wss://, the host and /coop, and its message formats are text, such as join id=, hpsetup serial=, skipvote cut= and vlobby on= (measured). Voice is 16 kHz PCM handed to voice.rs; with no WebRTC, the socket is its only way out (reasoned). "co-op: the race's host is out of it" confirms the hand-over the notes describe (measured).
• An HTTP API for the rest: /ranked?do=result, /event?do=duel, /blacklist?do=claim, /pinkslips?do=buy, /tunes?do=share, /friends, /profile and more (measured strings). Idle, the page asked only /whoami, /role (mine: player), /players, /discord, and /ping once a minute (measured).
• Saves are files. The engine's file layer sends GET with Range, PUT, POST and DELETE, and names options, challenges and "career save" among what it writes (measured strings). Careers are therefore files the server keeps per account (reasoned).
• Anti-cheat shows only as a client module, raceaudit.rs (94 functions), and a race line with "skill" and "cheat" values; online stays locked until "THE PROLOGUE'S BEATEN AND YOUR FIRST CAR'S BOUGHT" (measured strings). What the server checks, I cannot see.

What this corrects

From outside, I got these wrong or left them open:

1. The porting path. I said a decompilation with new code in its gaps and a new engine both fit, and that I could not tell them apart. It is the new engine (measured), and the widget and table above now place it there.
2. The "older graphics mode" is WebGPU's compatibility mode, not WebGL 2.
3. The cache is the Cache API. It is not the Origin Private File System, as with GTA V.
4. Threads. I said the game page would need COOP and COEP headers for threads. It has no threads and sends neither.
5. "PC" is a native Windows build, not only the browser.
6. The bucket holds a converted game, not the 2005 game folder; only the sound banks and films are EA's files, and the films are re-encoded.

Who owns what, revisited

Neutrally again. NFSMW Online does not distribute speed.exe or any of EA's code: its manifest has no executable, and its module is Rust (measured). It does serve EA's assets to every account: the music, speech and cutscene audio as shipped, the story films re-encoded, and the world, the cars and Carbon's canyons converted into its own formats. The installers download the same (measured manifest, reported installers). The itch.io port, by contrast, streams 2.97 GB of retail files including speed.exe from a third party's CDN, and web.nfsmwo.com lists its 4.48 GB folder, speed.exe included, to anyone. Converting a file's format does not change who owns what is in it; that is a reading, not legal advice (reasoned). I found no statement from EA, and I am describing, not predicting.

How I checked, behind the login

• The account. I made one account for this piece, through the site's sign-up form, with a throwaway name and a randomly generated password. I gave no email and linked nothing. The credentials stayed outside this repository, and I used the account only to load pages.
• Five loads of the game page in headless Chromium with its software WebGPU adapter, the longest about six minutes. Chrome's DevTools protocol paused every response at its headers; game data over 5 MB, or of unstated size, failed there. At most 40 MiB of small files per run went into a throwaway profile. The last run served the module from an earlier run's copy, to spare the origin.
• What I read: the page, the glue, the manifest, /app as text, and the module, parsed with my own script.
• What I left alone: the Android app, the PC installer, libgame.so, every world file, the socket and the account settings. I unscrambled nothing, and the downloaded code and manifest are deleted.

How I checked from outside

• curl against /, /login, robots.txt and about 40 other likely paths, recording status, content type and headers; HEAD requests only for anything that looked like a game file. Nothing outside /login, the icons and /nfs-update/ answered 200.
• Headless Chromium (Playwright), six loads of the root at two viewport sizes, logging every finished request with its status, type and body size, plus one load that opened every update post. No form was touched.
• Certificate transparency (crt.sh), DNS lookups, ARIN RDAP for the origin address, the Cloudflare R2 404 body, the public Discord invite endpoint and the public Roblox groups API.
• The update notes: all nine posts read in full, all 23 screenshots viewed, four of them committed here.
• The decompilation's README and the decomp.dev progress API; NFSPluginSDK's README.

All observations are from 23 October 2026, and a project shipping six update posts in one day will have moved on by the time you read this.