One CAPTCHA that does it all

Bot detection with a risk score, dynamic Proof-of-Work, a honeypot with several traps, custom security rules, design control and the compliance tools larger teams ask for. All of it runs in one CAPTCHA, built and hosted in the EU.

Start Free Trial Contact Sales

Attack Protection

Dynamically scaled bot attack protection

Dynamic Proof-of-Work keeps verification almost instant for legitimate users while making each request progressively expensive for attackers. Unlike one-size-fits-all CAPTCHAs that slow everyone equally, the challenge adapts per visitor: humans flow through unaffected, while large-scale abuse quickly becomes economically unviable.

Scales with the threat — the more suspicious the traffic, the harder the computational challenge becomes. Attackers are slowed down automatically while real users remain unaffected.
Default barrier against automation — many crawlers, scripts, and entry-level bots can't complete the proof-of-work at all and are filtered automatically before they ever reach your forms.
Intelligent analysis — does more than IP rate limiting: it looks for inconsistencies and automation indicators, weighs the overall request volume and factors in static signals.
Hardened against evasion — effective even when attackers switch IPs, rotate device data, or clear cookies. Multiple independent data points are evaluated simultaneously, so no single signal change can undermine the protection.

Legitimate Users

Fast & unnoticed

Human Verification Time

2 s

Humans pass instantly.

VS.

Under Attack

Hard & expensive

Bot Verification Time

60 s

Bots get stopped.

Fine-tune challenge difficulty with custom rules

Create proof-of-work difficulty rules to adjust challenge intensity for specific traffic patterns, from 20% (faster) up to 500% (more secure).

Optimized out of the box — every verification ships with a balance of security and user-friendliness already tuned for typical devices and traffic patterns. Defaults work well for most setups, so rules are only needed when you have unique requirements.
Adjustable difficulty multiplier — lower the difficulty for trusted traffic or increase it up to 5x for suspicious patterns.
Condition-based targeting — target rules by IP, country, language, time zone, browser, OS, or device type with flexible match logic.

Proof of work difficulty rule editor with difficulty multiplier slider and conditions

What sets TrustCaptcha apart

Bot Detection

Real bot detection beyond slowing them down

Most EU CAPTCHA providers only make bots slower. TrustCaptcha also identifies them and gives you a risk score to act on.

Identify and stop bots and spam — TrustCaptcha computes an individual risk score for every single request, telling you how likely it is to come from a bot.
Static & dynamic signal analysis — bot signals, inconsistencies, automation indicators, and request patterns all flow into one multi-layered risk assessment, transparent and explainable for every request.
Resistant against AI-powered bots — modern AI agents can mimic human behavior, but they can't fake the underlying signal patterns and they still have to solve the cryptographic Proof-of-Work. Multiple independent signals flag AI-driven automation even when it tries to imitate real users.
Detailed insights — every verification returns a clear breakdown: the bot score, why it was scored that way, a recommended allow-or-block action, and rich context on the request, from device and browser to country and origin.
You stay in control — use TrustCaptcha's risk insights to decide what's right for your site: let the request through, ask for step-up authentication, flag the session, or block it entirely. We surface the risk, you always make the final call.

TrustCaptcha widget - Start verification

Legitimate Request

Likely human

7 /100

Bot Score

Natural behavior

Normal speed

No automation detected

Suspicious Activity

Likely bot

92 /100

Bot Score

Unnatural behavior

Fast speed

Automation detected

Security Rules

Individual security rules for full control

Go beyond simple blocklists. Define advanced, multi-criteria access rules tailored to your exact security needs.

Multi-condition rules — combine IP addresses, countries, languages, time zones, browsers, OS, and device types in a single rule.
Flexible match logic — choose match any, match all, or match none, then set the action to allow or block.
Named & time-bound — give each rule a name, description, and optional expiration date for temporary policies.

Access rule editor showing name, match mode, action, and configurable conditions

IP allowlist with editable IP address and range entries

IP allowlists, blocklists & geoblocking

Quick controls for common scenarios, each backed by an access rule under the hood.

IP allowlist — trust specific IP addresses or ranges to always pass verification.
IP blocklist — block known bad actors by IP address or range with a single click.
Geoblocking — restrict or allow traffic from specific countries, in either blocklist or allowlist mode.

Bypass keys for safe testing

Skip verification in tests — generate keys that always pass the CAPTCHA with a bot score of 0. Ideal for automated function tests and CI/CD pipelines.
Optional expiration — set an expiration date or let keys live indefinitely. Remove them anytime with a single click.

Bypass key creation and management table with description, masked key, and expiration

Honeypot

Advanced honeypot protection that stops spam

A honeypot is an invisible field added to your forms that real visitors never see or fill in, while automated spam bots do. It's one of the simplest, most reliable ways to keep spam out, and TrustCaptcha builds several into every CAPTCHA for a dedicated layer of spam protection with zero setup.

Invisible to your visitors — multiple hidden trap fields sit inside every CAPTCHA and stay completely invisible to real users. They see no extra UI and have nothing to do.
Broader spam coverage — several honeypot techniques work in parallel, so you catch a wider range of spam bots than any single trap could.
Zero setup — it works the moment you embed the widget, and there is nothing to configure or maintain.
Spam stopped before it lands — spam bots are filtered out before they ever reach your forms, inbox, or database, keeping junk submissions out of your data.
A dedicated anti-spam layer — the honeypot runs alongside Proof-of-Work and bot scoring, adding a line of defense focused specifically on form spam.

Your protected form

Name

Anna Becker

anna.becker@example.com

Invisible to humans Website

Hidden by the CAPTCHA, so only spam bots fill it in.

Submit

Real visitor

Trap left empty → passes

Spam bot

Trap filled in → blocked

Verification Security

Verification that can't be bypassed

Every verification result is single-use, time-bound, and confirmed by your server through our API. A successful CAPTCHA can never be replayed, faked, or accepted from the frontend without your backend having the final word.

Single-use tokens — every verification produces a token that's accepted exactly once, so one human's successful CAPTCHA can never be reused to wave through additional bot requests.
Server-side validation — your backend confirms every token through our API using your secret API key. Users can't fake a successful verification, disable the CAPTCHA from their browser, or have their request accepted without your server's approval.
Token lifetime — every token has a defined lifetime, so verifications stay valid only as long as they should. Old or unused results can't be reused much later by an attacker who managed to capture them.
Customizable token policies — adjust token lifetimes and validation behavior to fit your security model. See the documentation for the full set of options you can tune.

Screenshot showing secure server-side verification result with signed token data

Environments

Multiple CAPTCHA environments, fully separated

Create dedicated environments for staging, production, development, or any setup you need, each completely isolated.

Fully isolated data — each environment has its own settings, rules, analytics, and exports with no data mixing between them.
Preconfigured defaults — every new environment ships with sensible defaults tuned for real-world traffic, so you launch in minutes and only adjust what's unique to your setup.
Independent credentials — rotate API keys and secrets per environment without affecting other setups.
Safe testing — test configuration changes on staging or development before rolling them out to production.

Verification results table showing timestamp, origin, IP, device, duration, bot score, and status

Verifications

Full transparency into every verification

Browse, filter, and export all verification data, so you always know exactly what's happening. Verification insights and export are part of the Enterprise plan.

Detailed results table — timestamp, origin, IP address, device, OS, browser, duration, risk score, and status at a glance.
Every attempt, even unsolved — the list shows started, unsolved, passed and failed attempts with a provisional score, so bot waves that never solve the challenge become visible.
Data retention — 48 hours by default, configurable up to 7 days. Custom time range selection included.
Export anytime — download your verification data as CSV, Excel, or JSON.

Understand every decision with verification insights

Full verification timeline — see every step from creation to result retrieval, including captured data, access decisions, and computed risk scores.
Decision transparency — understand exactly why a verification passed or failed: a custom rule, a bypass key, or a risk score threshold.
Rich context — country, region, city, device, browser, framework, proof-of-work difficulty, and who retrieved the result.

Verification insights showing timeline, decision process, and computed risk data

Analytics

Real-time analytics and traffic insights

Understand exactly what's happening on your site, from verification volumes and bot scores to device data and regional patterns.

Flexible time ranges — switch between 24h, 7 days, 30 days, 90 days, or define a custom period.
Multiple chart types — switch between pie charts, bar charts, and table views for every metric.

Verification metrics — track started, finished, and fetched verifications with daily and weekday breakdowns.
Risk score analysis — monitor bot score distributions, history, and verification durations.
Device & browser data — see operating systems, browsers, device families, and screen resolutions at a glance.
Behavioral & regional data — countries, time zones, languages, and user behavior patterns across all your traffic.

Verification analytics showing started, finished, and fetched verifications over 30 days

Device analytics showing operating system, browser, device family, and screen resolution

Bot score distribution, classifier, and duration history charts

Widget Customization

A CAPTCHA widget that looks like your brand

Make TrustCaptcha look and feel like a native part of your product rather than a third-party add-on.

Full design control — customize text colors, background colors, border colors, border width, and corner radius from sharp edges to fully rounded (Team plan and above).
Light & dark themes — switch between light and dark mode, or let it adapt to the user's system setting automatically.
Remove logo — hide the TrustCaptcha branding completely with the paid Captcha Branding add-on.
Unlimited languages — 37+ ready to use out of the box, with full freedom to add any other language.
Auto language detection — the widget automatically detects your page's language, so every visitor sees a native experience without extra integration code.
Custom translations — override existing texts, add your own tone of voice, use emojis, or add entirely new languages.
Responsive on every screen — the widget adapts automatically to phones, tablets, desktops, and even cramped inline contexts, so it always fits naturally into your layout.
Fully invisible widget — run verification completely hidden, with no visible UI, through the Captcha Branding add-on.
Privacy link — optionally display a custom link, e.g. to your privacy policy, directly inside the widget.

Accessibility

Over 1 billion people have disabilities. Your CAPTCHA shouldn't be a barrier.

TrustCaptcha has no puzzles, so people with visual, motor or cognitive impairments get through your forms the same way everyone else does.

No puzzles, no images — no selecting fire hydrants, no dragging objects, no deciphering distorted text.
Autostart — verification begins automatically when users interact with your form. No clicks required.
No time limit — users can take as long as they need. No pressure, no expiration.
ARIA labels & screen-reader text — every element ships with thoughtful ARIA labels and screen-reader-friendly text out of the box. All of it can be overridden, translated, or adapted to your wording and context.
WCAG & EAA aligned — designed to meet WCAG and the requirements of the European Accessibility Act, so the CAPTCHA does not lock anyone out of your forms.

Privacy & Compliance

Privacy-first architecture, built for compliance

Privacy by design shapes how TrustCaptcha works: it processes only the data a bot check needs, in EU data centers and without cookies.

EU-only hosting — all data is processed and stored exclusively in the EU on ISO 27001-certified infrastructure. No data transfers to third countries.
No cookies — TrustCaptcha works entirely without cookies, so nothing is stored in your visitors' browsers.
GDPR-compliant — purpose-limited processing and short retention periods, scoped to the CAPTCHA's job as a security control.
Sample privacy policy text — a starting point in our documentation for the TrustCaptcha part of your privacy policy, ready to adapt to your setup.

Illustration representing GDPR compliance and data privacy

Contracts & compliance, managed online

Standard DPA — sign a data processing agreement directly online, no back-and-forth required.
Custom contracts — individual terms are possible: our team prepares custom agreements you can review and accept directly on the platform.
Central contract management — accept, decline, cancel, or replace contracts anytime. Download PDFs, track consent history, and see who agreed to what and when.

Contract management platform showing pending approvals, active contracts, and consent history

Built for maximum availability

Redundant infrastructure, continuous monitoring and an automatic fallback keep verification running around the clock.

Redundant infrastructure — every layer of the verification stack runs with built-in redundancy across multiple EU regions.
Continuous health checks — automated health checks monitor every service around the clock.
Automatic failover — if an instance fails, the fallback reroutes traffic to healthy instances automatically, so visitors can still complete verification.

Illustration representing reliable, redundant infrastructure

Members management showing users with their roles and pending invitations

Users & Roles

Team management with granular permissions

Multi-user management — manage your CAPTCHA product with your entire team. Invite users, even people who don't have an account yet, assign roles and manage pending invitations.
Role-based access — give each teammate one or more roles, such as Admin, Member, Product Manager, Billing, Auditor or Legal. Teammates without a role can only view.
SSO & MFA enforcement — single sign-on with OIDC or SAML 2.0, with guided setup for Entra ID, Okta, Google Workspace, Keycloak, ADFS and Auth0. Enforce two-factor authentication for all team members.
Automatic access — invitation rules for your e-mail domains, just-in-time roles from your identity provider and memberships that end on a set date.

Audit Logs

Complete audit trail for every action

Meet your audit and compliance requirements with a detailed, exportable log of everything that happens across your product.

Everything tracked — user invitations, API key changes, bypass keys, access rules, IP lists, geoblocking, billing events, contract changes, role updates, failed sign-ins, password changes, exports and more.
Who did what — every entry shows the actor (team member, API key, automation or system), the affected object and the action taken. Expandable details reveal the exact values before and after, and secrets are redacted.
Retention of up to 2 years — 30 days on Team and 90 days on Enterprise, up to 2 years with the Governance add-ons. Filter by preset or custom time ranges.
Export, API & SIEM streaming — export as JSON, CSV or Excel, read events through the audit log API, or stream them in real time to Splunk, Datadog, Elastic or any HTTPS endpoint, signed and retried.

Audit log table showing timestamp, actor, subject, and action for all product events

Support

Support at the level you need

Team and Enterprise include best-effort e-mail support. The Priority, Technical and Enterprise support add-ons add guaranteed response times and direct access to our engineers.

Guaranteed response times — with a support add-on, we answer within 24 working hours or 8 hours depending on the add-on, plus up to 4 support hours a month.
Developer & integration support — hands-on help from software engineers for integration, migration, and technical questions.
Easy migration — step-by-step migration guides plus hands-on engineer help for switching from any other CAPTCHA. Most teams are off their old provider and live with TrustCaptcha the same afternoon.
Health checks & procurement — integration and health reviews with the Technical and Enterprise support add-ons, plus help with your procurement process.
Dedicated account manager — on custom plans, a single point of contact who understands your setup and priorities.