Human verification for the AI era
The SDK profiles mouse, keyboard, scroll and load fingerprints before a challenge is even issued. Low-risk users pass instantly — most real humans never see a captcha.
Rotated and warped glyphs, dynamic font streams, AI-generated spatial geometry, decoy interference — every challenge races the latest OCR and vision models.
Behavioral analysis + Proof-of-Work + explainable risk engine + one-time tickets work as four coupled layers. Breaking any single layer gets you nowhere.
This section embeds the real verification widget and talks to the live service — behavior analysis, challenge issuance, verification and tokens are all handled server-side. Switch tabs to change the challenge type, click the component button to verify; hit Reset if something goes wrong.
All are issued dynamically by the server and rotated deterministically by risk level. All 8 types can be triggered manually in the demo above.
Click the target glyphs as prompted; glyphs are rotated, warped, channel-shifted and overlaid with a grid.
Glyph renderingDrag along the given path into the target zone; the server silently validates speed, jitter and pause rhythm.
Trajectory checkSlide the missing piece to the right spot — but only after completing a SHA-256 Proof-of-Work.
PoWPut the three fragments back in order; outlines and base image are generated server-side.
PoWAlign the inner and outer rings; direction, angle and step count are all randomized server-side.
PoWPick the real glyph out of highly similar decoys, rendered live by an independent rendering service.
Font countermeasureGlyphs render client-side as a dynamic font stream — screenshots and frame-by-frame OCR cannot reconstruct them.
Needs render serviceClick the matching target inside AI-generated 3D geometry; spatial understanding is a known weakness of generic vision models.
AI generatedThe SDK samples mousemove / click / keydown / scroll frequency, pointer kinematics and load timing, and scores risk before a challenge is issued. Machine and human trajectories are statistically separable.
Slider, puzzle and spatial challenges embed a SHA-256 target computation. The client must spend real compute to obtain a valid answer, geometrically raising the cost of batch attacks.
A versioned scoring engine combines IP / ASN reputation, request frequency, device consistency and behavior score. Each signal is capped so no single anomaly can spike or flatten the verdict.
On success a one-time verification token is issued and atomically consumed by the server in Redis. Tokens cannot be forged or replayed; your backend does a single check.
Four steps: create a site, include the SDK, render the captcha, verify the token server-side. See the quickstart docs for details.
Create a site in the console to get a Site ID (e.g. cpt_xxxxxxxxxxxx). Site IDs are public — never expose your Secret.
<script src="https://res.25y.cn/corptcha/corptcha.iife.js"></script>Corptcha.render('#corptcha-widget', opts)Send the one-time token with your request; the backend confirms it with the verification service before allowing access — never trust booleans.
<script src="https://res.25y.cn/corptcha/corptcha.iife.js"></script>
<div id="corptcha-widget"></div>
const widget = Corptcha.render(document.querySelector('#corptcha-widget'), {
apiBaseUrl: 'https://cpt-api.25y.cn',
siteKey: 'your-site-id', // e.g. cpt_xxxxxxxxxxxx
purpose: 'login',
theme: { mode: 'auto' },
onSuccess(token) {
submitForm(token); // put the token into the form and submit
},
});Free SDK · Integrated in minutes · Full steps in the quickstart docs
Sign up now and upgrade to Pro for free — unlimited site domains and verification requests. Business and above support online purchase, activated instantly after payment.
Everything you want to know before integrating.
A human-verification system for the AI era: behavioral pre-screening, 8 adversarial challenges and Proof-of-Work. Low-risk users pass instantly; challenges are only issued to suspicious traffic.
Sign up for a siteKey, load the SDK on the frontend to render the widget, and verify the verification token on your backend. Integration takes minutes — see the guide above.
No. Corptcha is a closed-source commercial product. The SDK is free to integrate; the source code is not provided.
Verification data is stored in Corptcha's cloud (domestic nodes in China), encrypted in transit and at rest, and never shared with third parties.
Low-risk users pass instantly via behavioral pre-screening. Proof-of-Work and challenges only apply to suspicious traffic, so real visitors barely notice.
Unlimited site domains, unlimited verification requests, all advanced challenges and the full dashboard — unlocked the moment you register.
Register free