Data & Architecture

Last updated: August 29, 2026

This page explains, honestly, how ONCHAINSCANS is actually built — which parts are real, which parts run entirely in your browser, and which parts would need a real backend to go further. The goal is transparency, not marketing.

What this is

ONCHAINSCANS is a single static HTML page. There is no server, no database, and no user accounts behind it. Every feature either (a) reads public blockchain data directly from your browser, (b) calls a free third-party API directly from your browser, or (c) stores small amounts of data in your browser's local storage. Nothing is sent to us, because there is no "us" server receiving it.

Data provider layers

Layer	Provider	Used for
Blockchain data	Public RPC nodes (publicnode.com, llamarpc.com, Ankr, and each chain's own public endpoint)	Balances, contract calls, transaction lookups, ENS resolution
Market data	CoinGecko public API	Prices, market cap, trending tokens
Transaction history / indexer	Etherscan's unified API (optional, your own free key)	Wallet age, first/last activity, NFT transfer history, contract verification & source code
Token holders / NFT sale prices	Moralis Web3 Data API (optional, your own free key)	Top-holder concentration on Token Checker, recent NFT sale prices on NFT Checker
Airdrop data	Manually researched, edited via the local Admin workspace	The Top 10 board and "more airdrops" list

Because each layer is swappable in principle (a different RPC provider, a different market-data API, a different indexer), the code is organized so that swap is realistic — but there's no dependency-injection framework or config system here; it's a set of clearly separated functions in one file.

What's genuinely real vs. clearly labeled as unavailable

Real, with no setup

Multi-chain balance and portfolio checks (Ethereum, BSC, Polygon, Base)
Token/contract detection, ERC-20 metadata, NFT (ERC-721/1155) detection
Transaction lookup across all four chains, including decoded ERC-20 Transfer events straight from receipt logs
A contract's live owner() call, when present
ENS name resolution

Real, but needs your own free Etherscan API key

Wallet age, first/last activity, the Crypto Journey timeline
Contract verification status, deployment date, source-code-based risk indicators
NFT collection recent-activity feeds
Whale Tracker's recent-activity scan

Real, but needs your own free Moralis API key

Top-10 token holders and top-holder concentration on Token Checker, with known exchange/entity labels where Moralis has them
Recent NFT sale prices (last/lowest/highest/average over 30 days, and trade count) on NFT Checker — this is completed-sale data, not a live active-listing floor price
Real pooled DEX liquidity (Uniswap, SushiSwap, PancakeSwap and others) shown in Market Information and factored into a real Liquidity Depth risk indicator (🔴/🟡/🟢 based on the actual dollar amount found, or 🔴 if Moralis finds no trading pair at all)

Moralis' free "Starter" plan covers both of these at the time of writing, but usage limits and plan terms are set by Moralis and can change — check their current pricing page before relying on this for a high-traffic site.

Deliberately not built, and why

Live active-listing NFT floor price and NFT holder count — needs a marketplace-listing API (OpenSea, Reservoir) beyond the sale-price data above, not wired in.
Naming specific DeFi protocols a wallet used (e.g. "used Uniswap") — needs a maintained labeled-address database; guessing from a short list of famous contracts would misclassify far more than it'd correctly identify, so we don't.
Continuous whale/price monitoring and push alerts — needs a server watching new blocks and a notification service running 24/7. This build can only scan "recent activity right now," on demand.
Real user accounts, cross-device sync — needs a backend with a real database and authentication.
Secure admin authentication — a password checked in client-side JavaScript is visible in the page's own source code. That's not security, so we didn't pretend otherwise. The local admin workspace is a content-drafting tool for the site owner's own browser, not a secured multi-user system.

Caching, rate limits, and performance

There's a small in-memory cache (roughly 45–120 seconds) for price and market-data lookups within a single browser tab, to avoid redundant calls during one session. That's the extent of "caching" possible without a server. Real rate-limit protection, retries against a shared quota, and background pre-fetching all need a backend sitting in front of a shared API key — this build never uses a shared key; every user's requests go out under their own browser, and (for Etherscan) their own personal key if they add one.

Security

ONCHAINSCANS never asks for a seed phrase, recovery phrase, private key, or password, and has no ability to move funds. If you add an Etherscan API key, it's stored only in your browser's local storage and sent only to Etherscan's own API — never to us.

Accounts, sign-in, and settings

The avatar menu (top right) offers "sign in" and a Settings-style panel (language, currency, theme). Here's exactly what's real:

Email sign-in — fully local. Your name and email are saved in your browser's storage to personalize the greeting. There's no password check, no server, and no way for it to sync to another device or browser.
Google sign-in — uses Google's own client-side "Google Identity Services" library, which is a real, supported way to sign in without a backend. It only works if the site owner registers a free Google OAuth Client ID for the exact deployed domain and enters it when prompted. The profile info (name, email, picture) comes from decoding Google's token in the browser — for personalization only, not as a security boundary, since nothing verifies the token's signature server-side.
Apple and Twitter/X sign-in — off by default for the same reason. But there's now an opt-in escape hatch: connect a free Supabase project (Settings shown in the sign-in modal's "make this real" link) and all four providers, plus real password accounts with a real emailed verification code, start working — because at that point Supabase's own servers are doing the token exchange, password hashing, and email delivery, not this static page. You'd still need your own Apple Developer account and X Developer app regardless of Supabase, since those are Apple's and X's own requirements, not something any backend can bypass.
Account Security tab (once signed in) — the "wallet address" field and "Delete account" button are fully real local actions. 2FA, password, device management, and sign-in-activity logging are labeled "Requires backend" rather than faked, because a security toggle that doesn't actually verify anything is worse than none at all.
Theme (Light/Dark/System) — fully real, using CSS custom properties and prefers-color-scheme for "System". This preference is shared across the main app and these static pages (Privacy, Terms, Disclaimer, this page) via local storage, so they stay in sync.
Currency — fully real, using CoinGecko's own multi-currency price data (no exchange rates are invented here).
Language — real, but partial: it translates the main navigation, hero section, and footer tagline into a couple of languages. It does not translate the entire site — every checker page, every empty-state message, and all the airdrop research content is still English-only. Full translation would mean maintaining hundreds of strings across languages, which is future work, not something to fake with a dropdown that quietly does nothing.

If you want to take this further

The natural next step for a real product would be a small backend (even a lightweight serverless API) to: hold a shared, rate-limited indexer key server-side; run a background job that watches wallets and sends real push/email/Telegram alerts; store an airdrop database that an authenticated admin can edit live for every visitor; and add real user accounts for cross-device watchlists. None of that is present here — this is a static, client-only build, and this page exists so that's never a surprise.