Procaptcha
Procaptcha is Prosopo's privacy-first CAPTCHA — invisible, cookieless verification using behavioral analysis, fingerprinting and proof-of-work to stop bots.
Try Procaptcha Today
Start protecting your platform for free
What is Procaptcha?
Procaptcha is Prosopo's CAPTCHA. It verifies that a person is present without showing them a puzzle, and it is built so that verification does not require tracking anyone.
It is a challenge-response system like any other CAPTCHA — the server issues a challenge, the browser returns a response, the server verifies it. What differs is what goes into the response and who sees it.
How it decides
| Input | What it contributes |
|---|---|
| Behavioural signals | Whether the interaction pattern is consistent with a person being there |
| Browser coherence | Whether the client's claimed identity agrees with its observable capabilities |
| Proof of work | A measurable CPU cost per attempt, where it is configured |
| Network characteristics | Timing and transport properties that are hard to fake together |
No single input decides anything. The verdict comes from whether the set is internally consistent, which is substantially harder for an attacker to arrange than editing any individual value — and the resulting token is verified on your server, not in the browser.
Why it is built this way
Three deliberate choices, each with a reason worth stating.
Invisible by default. Puzzles are the part users object to, they exclude people with visual impairments, and solving services defeat them for a few dollars per thousand. A check that asks nothing avoids all three problems. Sessions that genuinely cannot be resolved can be escalated, rather than charging every visitor a puzzle to catch a minority.
No third-party tracking. Several widely deployed CAPTCHAs are run by advertising businesses, and their risk scoring depends on recognising users across sites. Procaptcha reaches a verdict about the session in front of it, which is a narrower question and needs far less data to answer. See what reCAPTCHA collects for the contrast.
EU processing available. This is the question privacy reviews actually ask, and the one that stops a deployment when the answer is "United States only".
Scope: presence, not identity
It is not identity verification. It establishes that somebody is there, not who they are, and the two should not be conflated — see human verification for why that distinction matters.
It also will not stop every bot, and no product will. What it changes is the cost and the reliability of automated abuse against your login, sign-up, checkout and API endpoints. The comparisons against reCAPTCHA, hCaptcha and Cloudflare Turnstile set out where the differences are, including where a competitor is the better fit.