WebDecoy
Catch AI scrapers and bots with deception, not friction
Start new thread

FCaptcha - Open source invisible CAPTCHA that catches AI agents

by•
FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.

Add a comment

Replies

Best
Hunter
📌
Hi Product Hunt! I'm Chris, founder of WebDecoy. We built FCaptcha because every CAPTCHA we tried had the same two problems. Real people got stuck clicking traffic lights, and AI agents driving a real Chrome window sailed straight through. Puzzles test vision. Vision models are now better at that than most humans. So FCaptcha does not ask a question. It watches how the browser was driven: pointer micro-tremor, velocity curves, typing cadence, coalesced input events, CDP attach signals, TLS fingerprints, and the tell-tale think-time gaps of an LLM deciding what to click next. Humans pass without noticing. Screenshot-and-click agents, computer-use agents and headless frameworks do not. A few things we are proud of: - Drop-in replacement. Same siteverify contract as Turnstile, reCAPTCHA and hCaptcha, so migrating is a base-URL change. - Accessible by design. No visual or audio puzzle to fail. WCAG 2.2 AA is verified in CI, and a benchmark of 14 human personas (screen reader, keyboard-only, tremor, elderly, touch) fails the build if false positives creep up. - Privacy first. Self-hosted, no cookies, no third-party data sharing, nothing written to disk. Every retention window is documented. - Polite agents welcome. Web Bot Auth (RFC 9421) signed requests are cryptographically verified and surfaced as their own category, so you can allow verified agents and block impersonators. - Runs anywhere. Go, Node or Python servers kept in lockstep, one docker run to start, Helm chart and Redis for multi-replica. It is MIT licensed and the scoring algorithm is fully open. Try the live demo, read the code, and tell us what gets past it. We want to know.