Stop automated sign-ups without slowing real customers.

OTCaptcha verifies every visitor in the background, raises the cost for suspicious traffic and tightens by itself during an attack.

Join the waitlist Try the checks

For sign-up, login, password reset and any other form.

Most visitors see neither. The loader is under 16 KB compressed, and the background check finishes before anyone notices it ran.

The check steps up only as far as the risk warrants.

Each step looks like part of your page, in your colour and in the visitor's language.

Most visitors: Nothing at all. The check runs while they finish the form. The page stays responsive, and there is nothing to click.
Looks suspicious: A short press and hold. A small box asks them to press and hold until it fills. It says what to do if they let go early, and it works with a finger, a mouse or a keyboard.
Looks automated: A slide puzzle. They slide a piece into the gap. A miss shakes the handle and lets them try again. Anyone who cannot drag can switch to the hold.

Try all three in your browser See how the box takes your brand

What visitors see

The real box on a phone, over a plain sign-up form. First in motion: a press, the fill, the pass. Then the hold waiting and part way through, the slide puzzle, and the moment the check passes.

The press and hold check on a phone: a press starts the fill, it sweeps across the button over a second and a half, and a green tick with the word Verified replaces it — The hold, as it happens: press, fill, pass

The press and hold check as a sheet at the bottom of a phone screen, waiting for a press — The hold, waiting for a press

The press and hold check part way through on a phone: the button is filling from left to right — The hold, filling under the thumb

The slide puzzle on a phone: the piece is half way to its gap and the handle sits under the thumb — The slide puzzle

The check has passed on a phone: a green tick and the word Verified — Verified

Three layers, in order

Every attempt goes through all three. None of them asks a normal visitor to do anything.

Proof of work
The visitor's device completes a short calculation in the background. Trivial once, costly at scale.
Risk signals
Automation traces, network origin and inconsistent device details are scored together. No single signal decides.
Server verification
Your backend confirms each pass. A pass works once and expires in minutes.

Attack response that runs itself

OTCaptcha learns your usual traffic. When volume or suspicious activity jumps, it steps up protection, then steps back down once the attack ends. Nobody has to be woken up.

Sign-up attempts during an attackIllustration, not customer data

Normal protectionProtection raised automatically

State	Work per attempt	Suspicious visitors
Normal	1x	Standard checks
Elevated	2x	Held sooner
Severe	4x	Held at the lowest risk score

What your developer does

On the page: One script, loaded with the page. It asks for a pass in the background.
On your server: One request to confirm the pass before the form is acted on. The secret never leaves your server.
Size: A loader under 16 KB, delivered compressed.
Hosting: Host the file yourself or load it from us.
Outage: Your sign-ups stay open if our service is unreachable.
Look: Brand colour, corner radius and light or dark, set per site.

The press and hold check on a dark page, in the dark palette the box takes from the system setting — On a dark page

Another site's accent and corner radius

Read the developer guide

JavaScript

// When the sign-up form is shown. A box opens only if needed.
otcaptcha.init({ captchaId: '[SITE KEY]' }, (widget) => {
  form.addEventListener('submit', (event) => {
    event.preventDefault();
    widget
      .onReady(() => {
        if (!widget.getValidate()) widget.showBox();
      })
      .onSuccess(() => sendForm(form, widget.getValidate()));
  });
});

Node.js

import { createHmac } from 'node:crypto';

const { captcha_id, ...fields } = pass;   // the five strings
const sign_token = createHmac('sha256', SECRET)
  .update(fields.lot_number).digest('hex');
const url = 'https://verify.otcaptcha.com/validate'
  + '?captcha_id=' + encodeURIComponent(captcha_id);
const body = new URLSearchParams({ ...fields, sign_token });
const res = await fetch(url, {
  method: 'POST', body, signal: AbortSignal.timeout(5000),
});
// Anything but a 200 is no decision, never a pass.
if (res.status !== 200) throw new Error('no decision');
const ok = (await res.json()).result === 'success';

PHP

$sign = hash_hmac('sha256', $pass['lot_number'], SECRET);
$body = http_build_query([
    'lot_number' => $pass['lot_number'],
    'captcha_output' => $pass['captcha_output'],
    'pass_token' => $pass['pass_token'],
    'gen_time' => $pass['gen_time'],
    'sign_token' => $sign,
]);
$type = 'Content-Type: application/x-www-form-urlencoded';
$ctx = stream_context_create(['http' => ['method' => 'POST',
    'timeout' => 5, 'ignore_errors' => true,
    'header' => $type, 'content' => $body]]);
$url = 'https://verify.otcaptcha.com/validate?captcha_id='
    . rawurlencode($pass['captcha_id']);
$raw = file_get_contents($url, false, $ctx);
$status = $http_response_header[0] ?? '';
// Anything but a 200 is no decision, never a pass.
if ($raw === false || !str_contains($status, ' 200 ')) {
    throw new RuntimeException('no decision');
}
$ok = json_decode($raw, true)['result'] === 'success';

mac := hmac.New(sha256.New, []byte(secret))
mac.Write([]byte(p.LotNumber))
form := url.Values{
	"lot_number":     {p.LotNumber},
	"captcha_output": {p.CaptchaOutput},
	"pass_token":     {p.PassToken},
	"gen_time":       {p.GenTime},
	"sign_token":     {hex.EncodeToString(mac.Sum(nil))},
}
endpoint := "https://verify.otcaptcha.com/validate" +
	"?captcha_id=" + url.QueryEscape(p.CaptchaID)
client := &http.Client{Timeout: 5 * time.Second}
res, err := client.PostForm(endpoint, form)
// Anything but a 200 is no decision, never a pass.
if err != nil || res.StatusCode != http.StatusOK {
	return false, errors.New("no decision")
}
defer res.Body.Close()
var a struct{ Result string }
err = json.NewDecoder(res.Body).Decode(&a)
return err == nil && a.Result == "success", nil

Python 3

digest = hmac.new(SECRET.encode(), p["lot_number"].encode(),
                  hashlib.sha256)
body = urllib.parse.urlencode({
    "lot_number": p["lot_number"],
    "captcha_output": p["captcha_output"],
    "pass_token": p["pass_token"],
    "gen_time": p["gen_time"],
    "sign_token": digest.hexdigest(),
}).encode()
url = ("https://verify.otcaptcha.com/validate?captcha_id="
       + urllib.parse.quote(p["captcha_id"]))
req = urllib.request.Request(url, data=body, method="POST")
# A non-200 raises: no decision, never a pass.
with urllib.request.urlopen(req, timeout=5) as res:
    ok = json.load(res)["result"] == "success"

Shortened. The developer guide has the complete samples, with error handling and the outage policy.

What you get back

Protection you can read about, not just trust. Every check is recorded without personal data, and the reports answer the questions a team asks after an attack.

Weekly report

Traffic, outcomes, attacks, new suspicious networks and solve times, once a week.

Attack timelines

Every automatic escalation is kept as one event: when it started, what raised it, which networks and countries were involved, and when it ended.

Challenge funnel

How many visitors who saw a hold or a puzzle finished it, gave up, or switched to the other check. Visitors who leave never reach your server, so this is the only place they show up.

Sites that never verify

A site that shows the check but never confirms passes on its server is unprotected. We name it, so an integration gap is noticed before an attacker does.

What is recorded, and for how long

Request early access

We are onboarding a small number of teams first.