Step by step

The mechanics of
CaptchaCore.

Adaptive Risk Engine, Proof of Work, behavioral analysis and threat intelligence work together — invisible to humans, unsolvable for bots.

Arrived here from the widget?

Briefly explained: what just happened

A website you visited uses CaptchaCore to check whether a request comes from a human or a bot. You did not have to click on traffic lights or decipher characters — the check ran in the background.

Open the privacy center

No cookies

The check sets no tracking cookie and no advertising pixel. Nothing is combined across websites.

No raw data

Mouse movement and typing rhythm are condensed into metrics inside the browser. The server only receives those values, never the movements themselves.

Servers in Germany

Processing takes place exclusively on servers in Germany, and IP addresses are stored in truncated form. No transfer to the USA.

One verification, four stops

What happens between page load and submit

Click a stage — on the right you can see what the widget and the server actually exchange at that moment.

GET /api/v2/challenge · 41 ms

Receive adaptive policy

profile: login pow: sha-256 · 4 nonce: EdDSA-signed ttl: 300 s

The 16 KB widget loads — nothing has happened yet, no cookie set.

How it works

7 steps in under 300ms

01

Page loads

16 KB

The V2 widget (16 KB gzip) loads asynchronously — it blocks neither rendering nor interaction. No framework, no dependencies.

02

Challenge policy

adaptive

The server sends an adaptive policy: challenge type, difficulty, site profile, UAM level — cryptographically signed with EdDSA.

03

Proof of Work

~200ms

The browser solves SHA-256 or memory-hard (Argon2) PoW in a WebWorker — the UI thread stays free, the user notices nothing. Difficulty adapts automatically.

04

Behavior & env fingerprint

in parallel

Mouse entropy, typing rhythm, touch events plus canvas timing, WebGL renderer, rAF cadence, storage APIs — exposes even disguised headless browsers. Only aggregated scores, no raw data.

05

Token + bindings

EdDSA

PoW solution + behavioral scores + signed bindings (origin, site, form type) are combined into the V2 token. No cross-site replay possible.

06

Adaptive Risk Engine

<50ms

Profile-based scoring: login stricter than contact form. Extensive IP archive (updated several times a day), campaign detection, confidence score, reason codes.

07

Decision

Score 0-100

allow, challenge, step_up or block — depending on site profile and form policy. The 4-level Under-Attack-Mode escalates automatically.

Proof of Work — SHA-256 / Argon2

Nonce:

a3f8c2e91b7d4f6...

Solution:

00007f3a9c1b...

Calculation ~200ms

Widget size (gzip)

reCAPTCHA
450 KB
hCaptcha
65 KB
CaptchaCore V2
16 KB

Layer 1

Proof of Work

Every browser has to solve a computation puzzle before the form can be submitted. Imperceptible for a single human (~200ms), prohibitively expensive for bot floods with thousands of requests per second.

  • WebWorker — never blocks the UI thread
  • SHA-256 (default) + Argon2 memory-hard (GPU-resistant at elevated risk)
  • Difficulty adjusted dynamically per site profile + under-attack level
  • Nonce: single-use, EdDSA-signed, no replay possible

Layer 2

Behavioral analysis

While the user fills out the form, the widget passively collects behavioral metrics. No raw data leaves the browser — only aggregated scores.

Mouse entropy

Shannon, 8 sectors

Typing rhythm

Inter-key intervals

Scroll/Touch

Events, velocity

Focus changes

Tab order

Characters typed

vs. pasted

Time-on-Page

Time until submit

Behavioral signals — live

2.7

Entropy

0.68

Rhythm

42

Events

Risk Engine — Sentinel

4

/100 risk score

0 — allow 30 — challenge 60 — block — 100
PoW Behavior Canvas WebGL rAF IP archive User-Agent Env ASN Geo Rate Threat-Intel Campaigns Profile Confidence

Layer 3

Adaptive Risk Engine

On the server, the Risk Engine evaluates all signals in context — a login is scored more strictly than a contact form. Site profiles and form policies control the thresholds individually.

allow

Human, allow — with confidence score and reason codes

challenge / step_up

Suspicious — additional interaction check or increased PoW

block

Bot detected — block

Detection

Human vs. bot

Real humans produce natural behavior patterns. Bots give themselves away through missing or artificial signals.

Human

Natural typing pattern detected

Mouse entropy2.7 (natural)
Typing rhythm0.68 (variable)
Time-on-Page12.4s
Env: webdriverfalse
Risk Score4 — allow

Bot (headless Chrome)

Instant fill detected — no typing pattern

Mouse entropy0.0 (none)
Typing rhythm0.0 (instant)
Time-on-Page0.2s
Env: webdrivertrue
Risk Score87 — block

Performance

The entire process in <300ms

Load widget

0ms

16 KB async/defer, non-blocking

Load policy

~10ms

Adaptive challenge policy from the server

Solve PoW

~200ms

SHA-256 or Argon2 in the WebWorker

Collect behavior

in parallel

Runs in parallel with PoW

Token + bindings

0ms

EdDSA-signed bindings, instant

Risk Engine

<50ms

Adaptive scoring + IP archive + threat intel

The benefit

What this means for your website

Technology is a means to an end. What counts is that your forms arrive, your legal team sleeps well and nobody has to solve a picture puzzle.

No picture puzzles, no drop-offs

Classic CAPTCHAs cost conversions: users fail at traffic lights and bicycles, and people with visual impairments fail even more often. CaptchaCore checks passively in the background. An interaction only appears when there is genuine suspicion.

  • Normally no image, text or audio puzzle
  • Keyboard operable and screen reader friendly
  • At most, the user clicks a single checkbox

GDPR without the small print

No transfer to the USA, no consent in the cookie banner, no third-party request from the widget. You conclude the data processing agreement electronically in your account, including a PDF for your records.

  • Processing exclusively in Germany
  • Data processing agreement under Art. 28 GDPR in one click
  • IP addresses anonymised, retention period configurable

Attacks cost the attacker, not you

Proof of work turns the economics around: a single request is imperceptible, a million requests get expensive. During a wave of attacks, under-attack mode escalates automatically in four levels.

  • Difficulty rises with attack pressure
  • Campaign detection across sites
  • IP archive updated several times a day

Integrated in minutes

Ready-made plugins for WordPress, WoltLab and Symfony, a Composer package for Laravel and a lean REST API for everything else. Two lines of code in the form, one line on the server for the check.

  • WordPress plugin with auto-update
  • Laravel middleware and Blade component
  • REST API with reason codes for your own logic

In comparison

CaptchaCore, reCAPTCHA and hCaptcha

The differences that end up in your privacy notice and in your load time.

Criterion CaptchaCore reCAPTCHA hCaptcha
Place of processing Germany USA (Google) USA (Intuition Machines)
Third-country transfer none yes yes
Consent required no usually yes usually yes
Cookies none yes yes
Widget size (gzip) 16 KB 450 KB 65 KB
User interaction normally none picture puzzles possible picture puzzles possible
Data processing agreement can be concluded electronically in the account online supplementary terms online supplementary terms
Self-hostable yes no no
Reason codes in the response yes no no

Details about third-party providers follow their public documentation, as of September 2026. Whether consent is required is ultimately decided by your own data protection assessment.

Frequently asked questions

What customers and visitors ask most often

Do I have to list CaptchaCore in the cookie banner?

No. The widget sets no cookie and loads nothing from third parties. Only in under-attack mode is a short-lived technical session cookie set, which is strictly necessary for operation. CaptchaCore does belong in your privacy policy, and we provide a ready-made passage for it.

What happens if a real person is blocked by mistake?

The risk engine has four outcomes, not two. When it is unsure it returns challenge or step_up, meaning an additional check rather than a block. Every decision carries reason codes, so the log shows exactly which signal was decisive and you can adjust the thresholds per form.

Does it work without JavaScript?

No, proof of work and behavioural analysis require JavaScript. For users without it you decide per form whether the submission is rejected, or allowed through and logged. Service outages follow the same principle: you decide whether traffic is blocked or let through in case of doubt.

How accessible is the check?

In the normal case there is nothing to operate. If an interaction does become necessary, it can be used with the keyboard and is marked up for screen readers. There are deliberately no image or audio puzzles, which people with visual or hearing impairments regularly fail.

What data do you as the operator of CaptchaCore see?

Aggregated metrics, risk scores and hashes, plus the truncated IP address and a hash of the user agent. No form contents, no mouse movements, no keystrokes. You set the log retention period yourself; the default is 30 days.

What does it cost and how quickly am I up and running?

There is a permanently free tier for private websites, with commercial plans above it. On WordPress the integration takes a few minutes: install the plugin, enter the site key, pick your forms. On request, invoices are issued as electronic invoices in ZUGFeRD format.

Ready to see it for yourself?

Try the check in the live demo, look at the pricing, or read in the documentation what the integration looks like.

Try the live demo View pricing Documentation

Permanently free for private websites · Processing in Germany · Data processing agreement in your account