Bot protection thatleaves people alone.
No traffic lights. No fire hydrants. No third attempt because you were not sure whether the pole counted. Most visitors are never asked to do anything at all — and the ones who are get something that takes about two seconds.
- Most visitors are never interrupted.
- More than thirty challenges, never the same one twice.
- Always a route needing no sight or steady hand.
- Nothing is stored about individual visitors.
- Free, and the exchange is stated up front.
Try two of them
30+ · never repeatedThese are two of the challenges, running right here. Neither asks you to identify anything in a photograph, and neither takes longer than a couple of seconds. What is measured is not whether you got it right — it is how your hand moved while you did it, which is the part no script has.
Draw along the line.
Follow it roughly — it does not need to be neat.
Tap every shape with three sides.
There may be more than one. No photographs, no traffic lights, no dataset to scrape.
Two of more than thirty. These are demonstrations running in your page — they issue nothing and record nothing. To see the real engine judge your actual browser, try the browser check .
What your visitors see
06 states · invisible is the defaultLive markup, not screenshots — these are the real states, in your own theme. Most visitors only ever meet the last one.
Privacy · TermsOne click. Often not even that — the invisible checks usually settle it first.
Privacy · TermsTypically about 300 ms. The spinner honours prefers-reduced-motion.
Privacy · TermsSuccess green is emerald-700 on light and emerald-400 on dark — the usual emerald-500 scores 2.39:1 on Paper and fails as text.
Privacy · TermsTokens live 120 seconds. Re-verification is silent.
Privacy · TermsFails open by default. A verification vendor must never take a customer’s signup form offline during its own outage.
ProtectedPrivacy · Terms
No widget at all — just this corner badge. It stays because it is the visitor's only route to the privacy disclosure.
Never the same one twice
128-bit seedOne seed decides the whole challenge — the rhythm, the curve, the cost. Press the button and watch every parameter change. This is also why the service can keep no record of what it asked you: given the seed, it can work it out again.
| seed (128-bit) | 3e43a9ab5183b4035a024c11bc2f2f6e |
| challenge drawn | trace |
| rhythm | 4 lanes · 11 notes |
| trace geometry | 2 bends · shallow |
| cost to the visitor | under half a second |
The parameter space here is well over 2100. At ten million challenges a day, the chance of any repeat across three months is around 10−21— so uniqueness needs no stored history, which is what lets the service keep no state at all. The hard part is not uniqueness but bounded randomness: every generated challenge still has to be solvable, unambiguous, and land in the difficulty band the risk score asked for.
When we say no
A block screen that only says “access denied” turns a mistake into a lost customer with nowhere to go. Ours names the innocent explanations first, carries a reference code, and offers a route back.
This request was blocked
We couldn’t confirm this is a real browser being used by a person. That’s usually automation — but it’s sometimes a privacy extension, a hardened browser, or a virtual machine.
If you’re a person, we got this wrong and we want to know. We read every report.
- Reference
- BC-7F3A-2291-K4
- Time
- 2026-08-11 07:52 UTC
- Site
- example.com
Why this happens · Check my browser · Privacy
Where it differs
06 thingsMost people are never asked anything
The check runs while the page loads and finishes before anyone notices. A challenge is what happens when we are unsure — not the default greeting for every visitor.
More than thirty challenges, never the same one twice
Every one is generated from a fresh seed, so nobody is solving a puzzle someone else already solved. There is no set of answers to buy.
Nobody is ever stuck
Every challenge carries a way through that needs no sight, no hearing, no memory and no steady hand — the device does a small calculation instead. That is what makes the interactive ones permissible at all.
Agents prove who they are, rather than say so
A user-agent string is a claim anyone can type. We check a cryptographic signature against keys the operator publishes, so a crawler you allow is one that can prove it is itself.
Your form still works when we are down
The widget fails open and tells you. An outage of ours must not break somebody's signup — your server still holds the line, because a missing token is still a missing token.
Verify without calling us at all
Tokens are signed with a public key. Fetch the keys once a day and check one yourself in about fifty microseconds — no round trip, no latency, and we never see your visitors.
Against the usual
| What you are used to | askFinz Captcha |
|---|---|
| Pick every square with a traffic light | Draw along a line, once, in about two seconds |
| The same puzzle set, solvable by farms | A fresh one each time, generated from a seed |
| Audio fallback that barely works | A sum, a word, or a spoken code — and proof of work underneath |
| Your visitors become someone's training data | Nothing is stored per visitor. There is no row to hand over |
| Free until it is not | Free, because our indexer is never blocked from your public pages |
One div and one script tag.
The client side is identical in every framework. On your server it is one check — or none at all, if you verify the signature yourself.
<div class="askfinz-captcha"
data-sitekey="af_your_site_key"
data-action="signup"></div>
<script src="https://captcha.askfinz.ai/widget.js" async defer></script>
<!-- On success a hidden input appears in the surrounding form:
<input type="hidden" name="askfinz-captcha-token" value="…">
Nothing else about your form has to change. -->Questions
Why is it free?
askFinz runs a web index, and an index is worthless if the pages it needs sit behind a captcha. So the exchange is stated plainly at signup: you get bot protection at no cost, and the askFinz indexer is never blocked from pages you already serve publicly. There is no toggle for that, on any plan. Every other crawler is off by default and entirely your choice.
What happens if a real person gets stopped by mistake?
They are never left with nowhere to go. Every challenge carries a way through that needs no sight, no hearing, no memory and no steady hand, and if all else fails their device does a small calculation instead. You can also tell us when we got someone wrong — that is the signal we most want and the hardest to get, because a wrong block costs you a customer and costs them their afternoon.
What happens to someone who cannot use a mouse?
They ask for the accessible route and get a sum, a word, or a spoken code — nothing needing a pointer, a steady hand or the sight of a moving target. Proof of work still runs underneath, so it is never a way in for a bot.
How do I know it actually stops anything?
We drive real automated browsers at it — stock Playwright, the usual anti-detection flag, and the stealth patches scrapers actually ship — and check none of them walks away with a token. The bar is 99%.
Run the same engine against your own browser.
The browser check uses the very same rules this captcha uses, and shows you every signal it reads — what it can tell about your browser, and what it deliberately does not look at. No account, and nothing is kept.