Open-source JavaScript library
Tells people apart from bots and AI agents by how they use the mouse and keyboard, and catches automation that clicks without looking.
Bots and AI agents that use a browser act like programs. They place the cursor right on a button instead of moving it there, release clicks within milliseconds, draw perfectly straight lines and type faster than any hand. This library records how a page is used and turns those traits into a verdict: human, bot, uncertain or not enough data, with the reasons behind it.
It has no dependencies and runs in the browser and in Node. From the keyboard it stores timings only, never which keys were pressed.
A cursor that appears on a button with no path to it, and clicks released in under 10 ms, as Playwright, Puppeteer and screenshot-based AI agents do.
Perfectly straight strokes at constant speed, and clicks on the exact centre of the element.
Keys held for a fraction of a millisecond, typing faster than a person, and fields filled from code with nothing human anywhere in the visit.
At the moment someone is about to click it, the button moves. A person sees the change and aims again; a bot clicks where it was, or chases it faster than anyone can react.
It catches automation that behaves like a program. It does not catch a bot built to imitate a person, and its thresholds still need checking against real users. The documentation explains every signal and every limitation.
Use the form as you normally would, then try the same with Playwright or an AI agent. The panel shows the verdict and the signals as you go. When you reach the main button, a notice appears and pushes it down: that is the trap.
Your movements stay in your browser: this copy of the demo sends nothing anywhere.