Sign-up
Keep fake accounts out of your customer base.
Stop automated sign-ups without slowing real customers.
OTCaptcha verifies every visitor in the background, raises the cost for suspicious traffic and tightens automatically during an attack.
Sample verificationPassed
- Time
- 142 ms
- Hashes
- 65,412
- Clicks
- 0
- Automation flag
- Not present
- Language
- en-US
- CPU threads
- 8
- Touch points
- 0
Sample values. Nothing is sent. Run the real check
Protect the pages bots go for first
Login
Slow down password guessing and stolen-password lists.
Password reset
Stop automated reset requests before they reach your customers.
Any other form
Add the same check wherever automation costs you money.
Three layers, no image puzzles for normal visitors
Every attempt goes through all three. None of them asks a normal visitor to do anything.
Proof of work
The visitor's device completes a short calculation. Trivial once, costly at scale.
Risk signals
Automation traces, network origin and inconsistent device details are scored together.
Server verification
Your backend confirms each pass. A pass works once and expires in minutes.
What your visitors see
The check steps up only as far as the risk warrants. Each step looks like part of your page, in your colour and in the visitor's language.
Nothing at all
The check runs while they finish the form. The page stays responsive, and there is nothing to click.
A short press and hold
A small box asks them to press and hold until it fills. It says what to do if they let go early, and it works with a finger, a mouse or a keyboard.
A slide puzzle
They slide a piece into the gap. A miss shakes the handle and lets them try again. Anyone who cannot drag can switch to the hold.
Try all three in your browser, or see how the box takes your brand.
Attack response that runs itself
OTCaptcha learns your usual traffic. When volume or suspicious activity jumps, it steps up protection, then steps back down once the attack ends. Nobody has to be woken up.
Normal protectionProtection raised automatically
| State | Work per attempt | Suspicious visitors |
|---|---|---|
| Normal | 1x | Standard checks |
| Elevated | 2x | Held sooner |
| Severe | 4x | Held at the lowest risk score |
What your developer does
- One script on your page and one check on your server
- About 12 KB gzipped loader, under 11 KB with brotli
- Host the file yourself or load it from us
- Your sign-ups stay open if our service is unreachable
- Brand colour, corner radius and light or dark, set per site
Sample integration
// In the browser const pass = await otcaptcha.check("[SITE KEY]"); // On your server const valid = await otcaptcha.verify(pass, "[SECRET]"); if (!valid) return rejectSignUp();
What you get back
Protection you can read about, not just trust. Every check is recorded without personal data, and the reports answer the questions a team asks after an attack.
Weekly report
Traffic, outcomes, attacks, new suspicious networks and solve times, once a week.
Attack timelines
Every automatic escalation is kept as one event: when it started, what raised it, which networks and countries were involved, and when it ended.
Challenge funnel
How many visitors who saw a hold or a puzzle finished it, gave up, or switched to the other check. Visitors who leave never reach your server, so this is the only place they show up.
Sites that never verify
A site that shows the check but never confirms passes on its server is unprotected. We name it, so an integration gap is noticed before an attacker does.
Request early access
We are onboarding a small number of teams first.