Step by step

The mechanics of CaptchaCore.

Adaptive Risk Engine, Proof of Work, behavioral analysis and threat intelligence work together — invisible to humans, unsolvable for bots.

Live · real SHA-256 in your browser

nonce—

tries0

hash—

time—

Arrived here from the widget?

Briefly explained: what just happened

A website you visited uses CaptchaCore to check whether a request comes from a human or a bot. You did not have to click on traffic lights or decipher characters — the check ran in the background.

Open the privacy center

No cookies0 cookies

The check sets no cookie and no advertising pixel and stores nothing in the browser. Nothing is combined across websites.

No raw datametrics only

Mouse movement and typing rhythm are condensed into metrics inside the browser. The server only receives those values, never the movements themselves.

Servers in GermanyDE

Processing takes place exclusively on servers in Germany, and IP addresses are stored in truncated form. No transfer to the USA.

One verification, four stops

What happens between page load and submit

Click a stage — on the right you can see what the widget and the server actually exchange at that moment.

Widget ↔ server● 1/4

GET /api/v2/challenge · 41 ms

Receive adaptive policy

profile: login pow: sha-256 · 4 nonce: EdDSA-signed ttl: 300 s

The 16 KB widget loads — nothing has happened yet, no cookie set.

How it works

7 steps in under 300ms

0116 KB

Page loads

The V2 widget (16 KB gzip) loads asynchronously — it blocks neither rendering nor interaction. No framework, no dependencies.

02adaptive

Challenge policy

The server sends an adaptive policy: challenge type, difficulty, site profile, UAM level — cryptographically signed with EdDSA.

03~200ms

Proof of Work

The browser solves a SHA-256 task in a WebWorker — the UI thread stays free, the user notices nothing. Difficulty adapts automatically.

04in parallel

Behaviour & environment signals

Mouse entropy, typing rhythm, touch events plus canvas timing, software rendering, rAF cadence, storage APIs — exposes even disguised headless browsers. Condensed metrics only, no raw data.

05EdDSA

Token + bindings

PoW solution + behavioral scores + signed bindings (origin, site, form type) are combined into the V2 token. No cross-site replay possible.

06<50ms

Adaptive Risk Engine

Profile-based scoring: login stricter than contact form. Extensive IP archive (updated several times a day), campaign detection, confidence score, reason codes.

07Score 0-100

Decision

allow, challenge, step_up or block — depending on site profile and form policy. The 4-level Under-Attack-Mode escalates automatically.

Layer 1

Proof of Work

Every browser has to solve a computation puzzle before the form can be submitted. Imperceptible for a single human (~200ms), prohibitively expensive for bot floods with thousands of requests per second.

WebWorker — never blocks the UI thread

SHA-256, with higher difficulty at elevated risk

Difficulty adjusted dynamically per site profile + under-attack level

Nonce: single-use, EdDSA-signed, no replay possible

Proof of Work — SHA-256Difficulty

Avg. tries

—

1 human

—

1M bot requests

—

Milliseconds for one browser — expensive for a bot farm with millions of requests.

What the browser loads (gzip)

Widget

16 KB

Compute worker

1,3 KB

Cookies

0

Layer 2

Behavioral analysis

While the user fills out the form, the widget passively collects behavioral metrics. No raw data leaves the browser — only aggregated scores.

Mouse entropy

Shannon, 8 sectors

Typing rhythm

Inter-key intervals

Scroll/Touch

Events, velocity

Focus changes

Tab order

Characters typed

vs. pasted

Time-on-Page

Time until submit

Behavioral signals — live

Move your mouse here — entropy rises

0

Entropy

0

Rhythm

0

Events

Risk Engine — Sentinel50 /100 risk score

0 — allow30 — challenge60 — block — 100

No signals yetchallenge

Layer 3

Adaptive Risk Engine

On the server, the Risk Engine evaluates all signals in context — a login is scored more strictly than a contact form. Site profiles and form policies control the thresholds individually.

PoW Behavior Canvas WebGL rAF IP archive User-Agent Env ASN Geo Rate Threat-Intel Campaigns Profile Confidence

allow

Human, allow — with confidence score and reason codes

challenge / step_up

Suspicious — additional interaction check or increased PoW

block

Bot detected — block

Detection

Human vs. bot

Real humans produce natural behavior patterns. Bots give themselves away through missing or artificial signals.

Human

allow

Natural typing pattern detected

Mouse entropy2.7 (natural)

Typing rhythm0.68 (variable)

Time-on-Page12.4s

Env: webdriverfalse

Risk Score4 — allow

Bot (headless Chrome)

block

Instant fill detected — no typing pattern

Mouse entropy0.0 (none)

Typing rhythm0.0 (instant)

Time-on-Page0.2s

Env: webdrivertrue

Risk Score87 — block

Performance

The entire process in <300ms

Load widget 0ms

16 KB async/defer, non-blocking

Load policy ~10ms

Adaptive challenge policy from the server

Solve PoW ~200ms

SHA-256 in the WebWorker

Collect behavior in parallel

Runs in parallel with PoW

Token + bindings 0ms

EdDSA-signed bindings, instant

Risk Engine <50ms

Adaptive scoring + IP archive + threat intel

0100 ms200 ms300 ms

The benefit

What this means for your website

Technology is a means to an end. What counts is that your forms arrive, your legal team sleeps well and nobody has to solve a picture puzzle.

01

No picture puzzles, no drop-offs

Classic CAPTCHAs cost conversions: users fail at traffic lights and bicycles, and people with visual impairments fail even more often. CaptchaCore checks passively in the background. An interaction only appears when there is genuine suspicion.

Normally no image, text or audio puzzle

Keyboard operable and screen reader friendly

At most, the user clicks a single checkbox

02

GDPR without the small print

No transfer to the USA, no consent in the cookie banner, no third-party request from the widget. You conclude the data processing agreement electronically in your account, including a PDF for your records.

Processing exclusively in Germany

Data processing agreement under Art. 28 GDPR in one click

IP addresses truncated, fixed deletion periods

03

Attacks cost the attacker, not you

Proof of work turns the economics around: a single request is imperceptible, a million requests get expensive. During a wave of attacks, under-attack mode escalates automatically in four levels.

Difficulty rises with attack pressure

Campaign detection across sites

IP archive updated several times a day

04

Integrated in minutes

Ready-made plugins for WordPress, WoltLab and Symfony, a Composer package for Laravel and a lean REST API for everything else. Two lines of code in the form, one line on the server for the check.

WordPress plugin with auto-update

Laravel middleware and Blade component

REST API with reason codes for your own logic

In comparison

CaptchaCore, reCAPTCHA and hCaptcha

The differences that end up in your privacy notice and in your load time.

Detailed comparison incl. FriendlyCaptcha →

Criterion	CaptchaCore	reCAPTCHA	hCaptcha
Provider's registered office	Germany (SpeedIT Solutions UG)	USA (Google LLC); Google Ireland Limited in the EEA	USA (Intuition Machines, Inc.)
Place of processing	Germany	on servers worldwide, according to Google	in the USA, according to its privacy notice
Cookies set by the widget	none	yes, _GRECAPTCHA for risk analysis	yes, technical cookies (incl. load balancing, session)
picture puzzles possible	no	yes, depending on the version	yes
Interaction in the normal case	none	depending on the version, none (v3) to a click (v2)	Click; passive mode in paid plans
Reasoning behind the decision	Reason codes in every response	Reason codes once a billing account is added	Score reasons in Enterprise

Third-party information based on their public documentation, as of September 2026 — with all sources in the detailed comparison. We do not give legal assessments.

Frequently asked questions

What customers and visitors ask most often

Do I have to list CaptchaCore in the cookie banner?

The widget sets no cookies, not even in Under Attack Mode, stores nothing in the browser and loads nothing from third parties. Whether you list CaptchaCore in your consent management is up to you and your data protection advisor. We provide a ready-made text module for your privacy policy.

What happens if a real person is blocked by mistake?

The risk engine has four outcomes, not two. When it is unsure it returns challenge or step_up, meaning an additional check rather than a block. Every decision carries reason codes, so the log shows exactly which signal was decisive and you can adjust the thresholds per form.

Does it work without JavaScript?

No, proof of work and behavioural analysis require JavaScript. For users without it you decide per form whether the submission is rejected, or allowed through and logged. Service outages follow the same principle: you decide whether traffic is blocked or let through in case of doubt.

How accessible is the check?

In the normal case there is nothing to operate. If an interaction does become necessary, it can be used with the keyboard and is marked up for screen readers. There are deliberately no image or audio puzzles, which people with visual or hearing impairments regularly fail.

What data do you as the operator of CaptchaCore see?

Risk scores, check results and salted hashes, plus the truncated IP address and the rough browser, operating system and device family. No form content, no mouse movements, no keystrokes. IP-related data is cleared after 30 days; the remaining statistics are kept for 7 to 365 days depending on the plan.

What does it cost and how quickly am I up and running?

There is a permanently free tier for private websites, with commercial plans above it. On WordPress the integration takes a few minutes: install the plugin, enter the site key, pick your forms. On request, invoices are issued as electronic invoices in ZUGFeRD format.

Ready to see it for yourself?

Try the check in the live demo, look at the pricing, or read in the documentation what the integration looks like.

Try the live demo View pricing Documentation

Permanently free for private websites · Processing in Germany · Data processing agreement in your account