spencermcw.com
[ << ] back to work
case file 05 / 14 · 2026

Taxedo

Official IRS forms, filled in your browser.

live Live at taxedo.pro; the source is private checked 2026-10-20 [1]

visit site (opens in a new tab)

A free, guided filler for official IRS forms: plain-language questions collect only what a form needs, and Taxedo fills in the official PDF. Everything happens in the browser, and the server never receives tax information. No e-filing: you print, sign and file it yourself.

what it does

  • 23 forms, among them the W-9, W-4, 4868, 8822, SS-4, W-8BEN, 9465 and 2848. [5]
  • Start a form from scratch, or import a filled copy or a photo of one; a photo or scan is read by OCR in the browser, and every imported value is reviewed before the PDF is made. [4]
  • Make any form fillable: give it a PDF without fields or a photo of a paper form, and it finds the fields and names them from their labels, for you to check, fill and download. [4]
  • Save progress in the browser or as a file, encrypted behind a passphrase. [3]
  • Sign-in is optional: every form works signed out. [3]
What it is
Client-side web app: guided interviews that fill official IRS PDFs
Stack
client React 19 · TanStack Router · Tailwind 4 · Vite 8 · pdf-lib · pdf.js · tesseract.js [2]
server Hono · Node 24 · SQLite (better-sqlite3) · OpenID Connect sign-in [2]
tooling TypeScript 7 · Biome · Vitest 5 · Playwright · axe [2]
Tags
  • TypeScript
  • React
  • PDF
  • Privacy

  1. No server route accepts form data (it answers 415), and an end-to-end egress test fails if anything a user types appears in any request. [2]

  2. A strict Content-Security-Policy on every response, same-origin only; no third-party scripts, fonts, CDNs or analytics. [2]

  3. Its own interview engine: a small, typed fact graph in TypeScript, with concepts borrowed loosely from the IRS's Direct File and nothing copied. [3]

  4. The official IRS PDFs ship with the app, hash-pinned, and are never fetched at runtime. [3]

  5. Saves are AES-GCM-256 with a key from PBKDF2-SHA-256 at 600,000 iterations, made in the browser. [4]

  6. The server keeps only accounts and sessions in SQLite, never form data. [2]

$ git log --reverse
  1. First commit; Form W-9 end to end the same day [6]
  2. The make-any-form-fillable tool, at /tools/fillable [6]

Every marked line above points at one of these: repositories and their docs, registries, live sites and screenshots. Nothing is inferred past what they show.

  1. [1] taxedo.pro (answers 200) taxedo.pro 2026-10-20
  2. [2] Taxedo README.md (private repository) 2026-10-20
  3. [3] PLAN.md: the spec and its decisions 2026-10-20
  4. [4] docs/DECISIONS.md 2026-10-20
  5. [5] apps/web/src/forms: one folder per form, all 23 marked live (and in taxedo.pro's bundle) 2026-10-20
  6. [6] Commit history, master at dffdb21 2026-10-20