Bots get a
silent no.
A WebAssembly verifier scores every session in under 200ms. Humans pass with no captcha. Bots get a poisoned token your backend quietly rejects.
Challenge. Verify. Verdict.
Three stages on every protected request — end to end in under 200ms.
Challenge
The loader pulls a nonce, a proof-of-work target and a per-session VM — wrapped in an opaque binary envelope.
Verify
A Rust→WASM core fingerprints 190+ signals, runs the VM, solves the PoW and collects automation + behaviour probes.
Verdict
The engine scores seven dimensions into one number. Humans get a signed token; bots get a poisoned reject.
No single signal decides.
Seven dimensions, scored independently. Any one critical tell ends it.
190+ signals — canvas, WebGL, audio, fonts — cross-checked for the impossible.
curl, Python and Go give themselves away in the handshake.
CDP runtime, Puppeteer / Playwright, worker-heartbeat debugger.
Pointer entropy and keystroke cadence — humans jitter, scripts don't.
Hashcash gate plus a per-session VM that rotates every challenge.
Decoy routes, datacenter ranges and velocity — instant flags.
Two outcomes. One is silent.
Humans pass untouched
No captcha, no friction — a signed token you trust offline. They never know a perimeter exists.
Bots get a poisoned token
A 200 OK indistinguishable from success. Your backend reads the reject; the bot thinks it won.
One script.
One offline check.
Drop the loader on your page; verify the token in your backend with your site secret. No callback to us on the happy path.
// frontend import { runChallenge } from '@instantblock/loader'; const { token } = await runChallenge({ sitekey }); // backend — offline, with your secret const claims = verifyToken(token, SECRET); if (claims.decision !== 'accept') block();
Catch yourself in real time.
Run the actual engine against this browser. Live client signals, a real proof-of-work, and the same seven-dimension verdict our customers get — nothing simulated.