Features
Everything the product does, stated plainly
This page lists implemented behaviour only. Anything still being built is described in the documentation, not here.
The public routes, dashboards and APIs on this site are backed by the same code paths described below, and the behaviour is covered by automated tests. See the documentation for the operational detail.
Processing
Processing
Decoding is asynchronous, durable and observable. The web request that accepts your file never waits for a decode.
Database-backed queue
Jobs are leased with row-level locking, so several workers can run at once without stepping on each other. Each lease has a heartbeat and an expiry.
Bounded retries
Transport faults are retried with exponential backoff up to a limit. Errors that cannot succeed on retry — such as a contract mismatch with the provider — stop immediately and surface to an operator.
Crash recovery
If a worker dies mid-job the lease expires and the job is reclaimed. The provider's job reference is stored first, so a restart resumes polling instead of re-submitting the file.
Validated results
A successful HTTP status is not treated as a successful decode. The result must be non-empty text of a sane size before it is stored and offered for download.
Security
Security
Uploads are untrusted input and confidential data at the same time.
Content-based validation
The file type is derived from the bytes. A binary renamed to .php is rejected, and an HTML page is rejected rather than queued.
Archive inspection
ZIP archives are parsed in-process and refused if they contain traversal paths, absolute paths, symlinks, encrypted entries, unsupported compression, an implausible expansion ratio or too many entries.
Escaped previews
Recovered source is shown as escaped text inside a pre element. It is never injected into the document, so a payload inside a decoded file cannot execute.
Ownership enforced on the server
Job reads, result previews and downloads all run an ownership check. A job id belonging to someone else returns not-found.
Account and billing
Account and billing
Entitlement is server state, never a browser claim.
Signature-verified payments
Webhooks are verified against the raw request body. Invalid signatures are recorded and rejected, and unsigned events never settle anything.
Idempotent activation
A payment can produce exactly one pass, guaranteed by a unique index rather than by application logic, so repeated notifications are harmless.
Amount and currency checks
A settlement whose amount or currency does not match the order is refused and recorded for review.
Exactly 240 hours
The expiry is computed from server-verified activation and enforced in every query that consumes allowance.
See it with your own file
A pass is €20 for 240 hours of access and does not renew. Upload a file you own and watch the job move through the pipeline.