Notabot: Stop bots, not humans!

Hey Product Hunt! 👋

We are building Notabot: a behavioral "CAPTCHA" designed to protect anything, while giving people a more human way through them.

The interaction is simple. Instead of deciphering distorted text or picking images from a grid, a visitor scratches a card and draws a shape chosen by the server. That deliberate gesture becomes the basis for the verification.

I wanted to share a little more about what happens behind that interaction, because the details matter.

The raw gesture stays in the browser. Notabot turns the movement into a 51-dimensional feature vector on the device. The raw coordinate and timing trail is deleted before anything is sent to the server. The server receives an encrypted representation of the gesture, not the path itself.

The check is based on an intentional action. Notabot doesn’t sit in the background judging random cursor movements. It evaluates the gesture the visitor makes for that specific challenge, looking at patterns such as timing, curvature, and the small corrections involved in movement.

There’s more than one layer of protection. The feature vector travels in a signed envelope bound to the session, challenge, origin, and timestamp. The server checks proof of work before scoring it with neural models. A successful check produces a short-lived, single-use proof token.

The real gate is your backend. The widget can tell the visitor that verification succeeded, but your application still needs to validate the token server-side before allowing the protected action. For developers, integration means adding the widget and making that server-side validation call. There are examples for Node, PHP, Python, Go, Elixir, and curl.

The goal is to make a practical trade-off: collect less sensitive raw data, give visitors a clear action, and still give developers a server-verified proof they can use to protect a form. It’s a security layer, not a promise that every automated attempt will be caught.

I’d especially love your feedback on two things: how the gesture feels as a visitor, and what you’d need to see as a developer before trusting a CAPTCHA on a real site.

Thanks for taking a look! 🙏