Self-Hosted Web App

OverclockedTax

Anonymous federal tax prep. The IRS forms get filled. Your identity never gets stored.

OverclockedTax walks you through a guided interview, computes your federal return, and produces IRS-ready PDFs — with every identity field intentionally left blank for you to complete by hand. The architecture is anonymous-by-design: no SSNs, no names, no addresses, no email, no phone numbers in the database. Ever. Returns themselves auto-purge one hour after the PDFs are generated.

OverclockedTax is not tax advice and is not an e-filing service. You print the forms it produces, fill in your identity information by hand, review every line, and mail them yourself.

OverclockedTax — Form 1040
1040
Tax Year 2024
Single · W-2 only · Standard deduction
READY TO PRINT
Line 1a — Wages, W-2 box 1$72,400
Line 12 — Standard deduction$14,600
Line 15 — Taxable income$57,800
Line 24 — Total tax$6,503
Name & SSN Left blank — fill in by hand
PRIVACY
Worksheet trail Every computed line, with formulas
PDF
Cover sheet Checklist of fields to handwrite
PDF

How It's Different

No PII at Rest. Ever.

The database has no column for a name, SSN, EIN, address, email, or phone. A CI guard fails the build if anyone tries to add one. The premise is load-bearing — every design decision flows from it.

Identity Fields Stay Blank

Every PDF field map flags identity-shaped fields with "identity": true. The fill engine skips them by construction, and a second CI guard fails the build if any identity-shaped field name is unflagged. You write your name, SSN, and signature on paper.

Returns Auto-Purge

Once your PDFs generate, the return is marked finalized with a 1-hour grace window. A garbage-collection cron runs every 15 minutes and hard-deletes the row plus every output file. If you didn't download the packet in time, you regenerate it — you don't recover it.

Guided Interview

Filing status, income (W-2), credits, and adjustments are collected through a step-by-step interview. Every numeric input becomes part of an integer-cents value object — no floats, no rounding drift, ever.

Worksheet Trail PDF

Every computed line ships with a derivation: the formula, the inputs, and the IRS instructions section it came from. Your packet includes a worksheet-trail PDF so you can audit the math line by line, not just trust a black box.

Cover Sheet Checklist

Alongside the IRS form, you get a filing-status-aware cover sheet: every place to handwrite identity info, items to mark by hand, and the assembly order for mailing. Print, fill, sign, mail.

Override Any Computed Line

The engine emits a computed value, but you stay in control. At Review, every line has an override field. The PDF renders the override if present — the computed value is a strong default, not a verdict.

Cross-Year Continuity

Each packet ships with a signed JSON export — HMAC-checksummed, schema-versioned, and zero PII. Save it. Next year, drop it back in to carry forward depreciation schedules, basis, and prior-year tax once Phase 2 lands.

Anonymous Login Codes

You get a session code at registration, paired with an Argon2id-hashed password. There is no email-based recovery. Lose the code, lose the session — that's the deal that lets the database stay PII-free.

Phased Roadmap

Each phase ships an end-to-end slice. The five tax years (2022, 2023, 2024, 2025, 2026) are first-class — every constant lives in a per-year file.

Phase 2

  • Schedule C — self-employment
  • Schedule SE — SE tax
  • Form 4562 — depreciation
  • Form 8829 — home office
  • Form 8995 / 8995-A — QBI
  • Schedules 1 & 2

Phase 3 & 4

  • Schedule D + 8949 — capital gains
  • Form 8606 — nondeductible IRA basis
  • Form 8889 — HSAs
  • Form 8863 — education credits
  • Schedule B — interest & dividends

Phase 5 & 6

  • Schedule A — itemized
  • Form 6251 — AMT
  • Form 8959 / 8960 — Add'l Medicare & NIIT
  • Form 1040-ES — estimated-tax vouchers
  • Schedule C accounting import

Tech Stack

PHP 8.2 + MariaDB

Boring tech on purpose. mod_php under Apache 2.4, MariaDB 10.6+, no SPA, no build pipeline, no JS framework. The runtime dep list is FPDI + FPDF only — SMTP is a hand-rolled socket client.

pdftk-java + FPDI

Official IRS fillable PDFs are filled at the field-name level with pdftk-java. Worksheet trail and cover sheet are rendered fresh from FPDF. PDFs are written to a per-return tmp directory outside the docroot.

Pure Calc Engine

The calc engine is a pure function: Engine::run(ReturnData) → ComputedReturn. No DB, no clocks, no I/O. Tax-year constants live in per-year files; TODO[YEAR-VERIFY] markers gate every numeric until a human checks it against the IRS instructions.

Integer Cents, IRS Rounding

Money is integer cents end-to-end — never floats. Full precision propagates through the dependency graph; IRS dollar rounding (<50¢ down, ≥50¢ up) is applied at the form-line level only, never on intermediates.

Argon2id + reCAPTCHA

Passwords hashed with Argon2id via PHP's password_hash(). Google reCAPTCHA v2 on registration and login. Per-session login lockout (5 fails / 15 min → 1-hour cooldown) lives in the app itself.

Hardened Apache vhost

HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, scoped CSP, and access-log redaction on the /confirm token path. Backups dump dollar amounts only — the no-PII guarantee survives the snapshot.

OverclockedTax is not tax advice.

This tool helps you produce paper IRS forms based on the answers you provide. It does not e-file. It does not guarantee accuracy. It is not produced by, certified by, or affiliated with the IRS or any tax authority. You are solely responsible for reviewing every line of your return, for the accuracy of your inputs, for filling in your name, Social Security Number, address, and signature on the printed forms, and for filing your return correctly and on time. If your situation is at all complex, consult a licensed tax professional.

Visit tax.overclockedapps.com