Humora

The Challenge

Existing CAPTCHA fails twice: it frustrates real users (and tanks conversion rates) while modern bots increasingly solve image puzzles faster than humans do. The replacement needed to verify humanity without asking users to prove they can identify traffic lights — and without giving bots a fixed pattern to train against.

The Approach

Verification shifted from correctness-based to behavior-based. The widget asks 5 personality questions where no answer is wrong; humanity is inferred from three signals captured simultaneously — which option a user picks (humans skew toward irrational, funny, or self-aware choices), how long they take (sub-300ms is bot territory; 800–4000ms is the natural human gut-reaction zone), and how organically they move the mouse or touch the screen. The question bank rotates one-per-category from 30 handcrafted prompts, yielding 7,776 unique session combinations — too sparse for a bot to memorize. Scoring runs entirely in JS memory (no DOM-readable scores), pass-state issues a server-signed JWT with 5-minute expiry, and the verification endpoint validates timestamps server-side to block replay and timing manipulation.

The Outcome

Shipped as a working open-source MVP with the full scoring engine, all 5 widget screens, JWT issuance, and an optional verification backend. The widget loads in ~30 seconds end-to-end (faster than reCAPTCHA v2's median completion), runs mobile-first with full touch entropy tracking, collects zero PII, and ships under MIT — self-hostable with no Google dependency.