F***Captcha Demo

GPT-4V, Claude, and other screenshot-based automation

Puppeteer, Playwright, Selenium, PhantomJS

WebDriver, Cypress, Nightmare, custom bots

Unusual timing from human solving services

Scripted movements, inhuman timing patterns

Same fingerprint from many IPs or vice versa

7 biometric metrics detect bots with timing jitter

Detects Playwright globals and reconfigured WebDriver

Flags synthetic touches: uniform pressure, zero contact-radius variance, missing identifiers

Passive accelerometer/gyro signal: flat readings expose mobile emulators

Computed natively from the TLS ClientHello when FCaptcha terminates TLS, with no proxy header to trust

Catches patched Chromium driving real input: a proxied Function.prototype.toString and permission states a genuine browser cannot produce

Separates events synthesised over the Chrome DevTools Protocol from input a person actually generated

When two or more independent behavioural categories agree, the score is floored. Agreement counts as evidence in its own right, so a browser that hides every static tell is still catchable by movement

Cost scales with how suspicious a source has recently been, measured in wall-clock rather than hash difficulty. A visitor who has done nothing wrong pays exactly what they paid before

Web Bot Auth signatures checked cryptographically against the signer's key directory, so a forged identity claim is distinguishable from a genuine one. Adoption is still thin, so it supplements the signals above rather than replacing them