Bot protection thatleaves people alone.
No traffic lights. No fire hydrants. No third attempt because you were not sure whether the pole counted. Most visitors are never asked to do anything at all — and the ones who are get something that takes about two seconds.
- Most visitors are never interrupted.
- More than thirty challenges, never the same one twice.
- Always a route needing no sight or steady hand.
- Nothing is stored about individual visitors.
- Free, and the exchange is stated up front.
Try two of them
30+ · never repeatedThese are two of the challenges, running right here. Neither asks you to identify anything in a photograph, and neither takes longer than a couple of seconds. What is measured is not whether you got it right — it is how your hand moved while you did it, which is the part no script has.
Draw along the line.
Follow it roughly — it does not need to be neat.
Tap every shape with three sides.
There may be more than one. No photographs, no traffic lights, no dataset to scrape.
Two of more than thirty. These are demonstrations running in your page — they issue nothing and record nothing. To see the real engine judge your actual browser, try the browser check .
Where it differs
06 thingsMost people are never asked anything
The check runs while the page loads and finishes before anyone notices. A challenge is what happens when we are unsure — not the default greeting for every visitor.
More than thirty challenges, never the same one twice
Every one is generated from a fresh seed, so nobody is solving a puzzle someone else already solved. There is no set of answers to buy.
Nobody is ever stuck
Every challenge carries a way through that needs no sight, no hearing, no memory and no steady hand — the device does a small calculation instead. That is what makes the interactive ones permissible at all.
Agents prove who they are, rather than say so
A user-agent string is a claim anyone can type. We check a cryptographic signature against keys the operator publishes, so a crawler you allow is one that can prove it is itself.
Your form still works when we are down
The widget fails open and tells you. An outage of ours must not break somebody's signup — your server still holds the line, because a missing token is still a missing token.
Verify without calling us at all
Tokens are signed with a public key. Fetch the keys once a day and check one yourself in about fifty microseconds — no round trip, no latency, and we never see your visitors.
Against the usual
| What you are used to | askFinz Captcha |
|---|---|
| Pick every square with a traffic light | Draw along a line, once, in about two seconds |
| The same puzzle set, solvable by farms | A fresh one each time, generated from a seed |
| Audio fallback that barely works | A sum, a word, or a spoken code — and proof of work underneath |
| Your visitors become someone's training data | Nothing is stored per visitor. There is no row to hand over |
| Free until it is not | Free, because our indexer is never blocked from your public pages |
One div and one script tag.
The client side is identical in every framework. On your server it is one check — or none at all, if you verify the signature yourself.
<div class="askfinz-captcha"
data-sitekey="af_your_site_key"
data-action="signup"></div>
<script src="https://captcha.askfinz.ai/widget.js" async defer></script>
<!-- On success a hidden input appears in the surrounding form:
<input type="hidden" name="askfinz-captcha-token" value="…">
Nothing else about your form has to change. -->Questions
Why is it free?
askFinz runs a web index, and an index is worthless if the pages it needs sit behind a captcha. So the exchange is stated plainly at signup: you get bot protection at no cost, and the askFinz indexer is never blocked from pages you already serve publicly. There is no toggle for that, on any plan. Every other crawler is off by default and entirely your choice.
What happens if a real person gets stopped by mistake?
They are never left with nowhere to go. Every challenge carries a way through that needs no sight, no hearing, no memory and no steady hand, and if all else fails their device does a small calculation instead. You can also tell us when we got someone wrong — that is the signal we most want and the hardest to get, because a wrong block costs you a customer and costs them their afternoon.
What happens to someone who cannot use a mouse?
They ask for the accessible route and get a sum, a word, or a spoken code — nothing needing a pointer, a steady hand or the sight of a moving target. Proof of work still runs underneath, so it is never a way in for a bot.
How do I know it actually stops anything?
We drive real automated browsers at it — stock Playwright, the usual anti-detection flag, and the stealth patches scrapers actually ship — and check none of them walks away with a token. The bar is 99%.
Run the same engine against your own browser.
The browser check uses the very same rules this captcha uses, and shows you every signal it reads — what it can tell about your browser, and what it deliberately does not look at. No account, and nothing is kept.