How Chessware works

Here's the whole journey, from paying to playing.

1. You sign in with Discord

Sign-in uses Discord OAuth. We receive your Discord user ID, username and avatar — that's the whole account. You get the Member role in our server.

2. You buy a plan

Checkout runs through Stripe. We record the order (what you bought, when, how much) and issue a license key to your account. Keys can also be given as gifts and redeemed on your dashboard.

3. You download and log in

The dashboard's Downloads tab serves the current build. On first log-in your key locks to your PC using an anonymous one-way hardware fingerprint hash, and your plan's time starts. From then on Chessware re-checks the license every few minutes — a revoked or expired key detaches the cheat mid-session.

4. The engines unpack

All four engines are packaged inside Chessware.exe. After sign-in they unpack into %LOCALAPPDATA%\Chessware\engines, each checked byte-for-byte against its pinned SHA-256. Every move the cheat suggests is calculated locally by these engines.

5. You inject

Pressing Inject:

1. Chessware starts its browser window — your Chrome or Edge with a dedicated profile in %LOCALAPPDATA%\Chessware\browser, so your normal browsing is untouched and the tab is always attachable.
2. It connects to the page over the browser's local debugging interface (the same one developer tools use).
3. It injects the payload — the menu, the board reader and the overlay — into the page. The payload lives in a closed shadow root: it never modifies the site's own board, so nothing on the page looks tampered with.
4. A toast appears in the bottom-right corner and the menu opens.

While you play, the payload reads the board (squares, pieces, orientation) and streams it to Chessware; the engines answer with the best moves; and anything you let it play is performed with trusted, browser-level mouse events — organic paths, human-like timing — rather than synthetic page events.

6. You stay believable

The features are the stealth: Elo ranges, play styles, occasional mistakes and random timing make the moves look human. The Disable anti-cheat toggle keeps the client side clean (trusted input, no site-DOM changes, organic timing); server-side statistics are why the human-like settings exist.

Security in plain words

• HTTPS everywhere; the server decides every license question.
• One-way hardware fingerprints; no passwords.
• Card details stay with Stripe.
• Engine files are checksummed before they run; builds are checksummed before they update.
• Sensitive strings inside the app are obfuscated, the app checks itself for tampering, and debuggers are refused.