Security

Last updated: July 26, 2026

A fair question I get asked: how do I know this isn't a fake Dhan login?

You shouldn't have to take my word for it. This page explains exactly what happens when you log in, and how to check it yourself without trusting me.

Voldash never sees your Dhan password

There is no Dhan login form on voldash.com. The "Login" button on this site is an ordinary link — it takes you to the Voldash app, and nothing on voldash.com ever asks for your broker credentials.

When you start the login, Voldash hands you off to Dhan's own website. You type your credentials there, on Dhan's domain, into Dhan's page. Dhan then asks whether you want to grant Voldash access. Only after you approve does Dhan send back an access token.

Your Dhan username and password are never transmitted to Voldash, never pass through my servers, and are never visible to me at any point.

How to verify this yourself

1. Check the address bar before you type anything. When the login page appears, the domain must be Dhan's own (dhan.co). If you are ever asked for Dhan credentials on a page whose address bar does not say dhan.co, stop — that is true here and on every other site.

2. The return address is fixed by Dhan, not by me. Voldash is registered with Dhan as a partner application, and part of that registration is a redirect URL locked to:

https://www.voldash.com/auth/dhan

Dhan will only ever send your login back to that exact address. This is the part worth understanding, because it's why the attack people are worried about doesn't work: someone who copies this website onto a different domain cannot receive that callback. The restriction is enforced on Dhan's side, where a copycat has no ability to change it.

3. You can revoke access whenever you want. Access lives in your Dhan account, not mine. Withdraw it there and Voldash immediately loses the ability to read anything.

Who operates Voldash

Voldash is operated by a private limited company registered in India:

Both numbers above are public records, and you can check them yourself in about a minute — neither lookup requires an account:

• CIN — MCA master data. Enter the CIN to see the registered company name, incorporation date, registered office, and current status.
• GSTIN — GST portal → Search Taxpayer. Enter the GSTIN to see the registered legal name and whether the registration is active.

A registration number is only worth something if you can verify it against the government's own records rather than mine. Please do.

What Voldash can and cannot see

What it reads: NIFTY option and index market data — the same public market data any Dhan Data API user can pull. This is what the volatility analytics are computed from.

What it never touches: your positions, your holdings, your order history, your trades, or your funds. Voldash cannot place, modify, or cancel an order. It is an analytics tool and has no trading function anywhere in it.

Where your data lives: in your own browser. Voldash has no user accounts and no user database. The market history it downloads is stored locally in your browser's own storage, and the analytics are computed on your machine.

Where your token lives: in your browser tab's session storage, which the browser clears the moment you close the tab. It is never written to permanent browser storage.

To be precise about one thing, because you can see it yourself in your browser's network tab: market-data requests are relayed through a proxy at api.voldash.com, and your token travels through that proxy so the request to Dhan can be authenticated. The proxy is stateless — it keeps nothing between requests, writes no token to any store, and does not log tokens. So there is no server-side store of user tokens to breach. I would rather tell you the token passes through than have you find it yourself and wonder what else I skipped over.

Still unsure?

Email contact@voldash.com and ask. If something here doesn't match what you observe, I want to know about it.