Not a captcha · a human test

the human test
a bot can't fake.

One touch. No squinting at traffic lights. It binds to your device's secure enclave — so a script, a headless browser, or an AI agent like Claude Code physically cannot complete it.

One touch ~2 seconds No biometric vault Offline-verifiable
[manav]human test checking environment…

Prove you're a person

Press and hold the circle. Keep your finger or cursor on it until the ring fills.

HOLD
Hold0%
Live entropy0%
Real input
    
              

    Runs entirely in your browser. Nothing is uploaded. The biometric never leaves your device — only a signed yes/no receipt does.

    Why a bot can't pass

    Three layers. The last one is physics, not a puzzle.

    Captchas fail because every puzzle an AI can see, an AI can solve. So we don't use a puzzle. We use signals a piece of software literally cannot produce.

    Layer 1 · soft gate

    Live human entropy

    A real hand never holds perfectly still. We sample micro-tremor, velocity variance, and timing jitter during the hold. A scripted press is too smooth and too regular — it scores near zero.

    Layer 2 · soft gate

    Trusted-input flag

    The browser stamps isTrusted on events that came from real hardware. A bot firing synthetic events with dispatchEvent cannot forge it — those events arrive isTrusted: false and we reject them.

    Layer 3 · the anchor

    Hardware liveness (WebAuthn + user verification)

    The decisive step asks your device's secure enclave to assert presence with a real fingerprint, Face ID, or device PIN. This prompt is owned by the operating system, not the page. An AI agent, a headless browser, or remote code cannot satisfy it — there is no API to fake a fingerprint into a real authenticator. That's the difference between "hard for bots" and "impossible for software."

    Honest comparison

    Easier for people. Impossible for software.

     Image captchaThis test
    Effort for a real personRead, squint, retryOne touch
    Solvable by modern AIYes — routinelyNo
    Solvable by a paid solving farmYesNo — needs the enrolled device
    AccessibilityPoor (visual/audio)PIN fallback, no vision needed
    Proof you can keepNoneSigned, offline-verifiable receipt
    Stores your biometricNever leaves the device

    Straight talk: Layers 1–2 raise the cost for casual bots but a determined automation driver (e.g. a debugged browser) can imitate them. Layer 3 — hardware user-verification bound to an enrolled device — is the part with no software bypass. That is why the verdict below treats WebAuthn as the anchor and the behavioral signals as supporting evidence.