FCaptcha
FCaptcha is an MIT-licensed CAPTCHA you run on your own infrastructure. It combines proof-of-work, browser and interaction signals, and short-lived signed tokens without visual puzzles, cookies, telemetry, or a required WebDecoy account.
Run the 5-minute quickstart → · Try the live demo · View the source
When to use FCaptcha
Section titled “When to use FCaptcha”Use FCaptcha when a signup, login, contact, checkout, or API-adjacent form needs an interactive challenge or invisible risk score and you want to own the service and its data path.
FCaptcha is separate from WebDecoy’s managed traffic-observation products:
| Product | Primary job | Operation |
|---|---|---|
| FCaptcha | Issue and verify short-lived CAPTCHA tokens | You self-host it |
| WebDecoy sensors | Observe and explain bot traffic across a site or application | Reports to your WebDecoy property |
| AI Protection | Apply admission and resource controls around AI-backed routes | Your backend integrates an SDK |
Two browser modes
Section titled “Two browser modes”| Mode | User experience | Endpoint |
|---|---|---|
| Interactive widget | A single checkbox with no image or audio puzzle | /api/verify |
| Invisible score | Your form triggers scoring without a visible challenge | /api/score |
Both modes return signed, single-use tokens. Your backend must verify the token before performing the protected action. A browser-side score alone is not authorization.
What is measured
Section titled “What is measured”FCaptcha evaluates browser consistency, interaction timing, pointer, touch, keyboard and scroll behavior, form interaction, proof-of-work timing, and server-side rate or replay state. Each decision is composed from explainable signals rather than an opaque model response.
Detection claims are intentionally bounded. The project runs a captured regression corpus on every release, publishes false-positive budgets, and documents classes it cannot safely distinguish. For example, paired Chrome Auto Browse and same-profile human captures did not produce a safe browser-internal detector, so no such enforcement rule was added.
The benchmark is a regression harness, not a population accuracy estimate. Read the benchmark methodology before quoting its results.
Server choices
Section titled “Server choices”The repository ships equivalent Go, Node.js, and Python servers, plus a public multi-architecture container image and a Helm chart. The browser client can be served by your FCaptcha server or pinned from npm with Subresource Integrity.