Browser passportPasseport navigateur

TypeP

Code···

Canvas render, as your graphics stack drew it

Engine / Moteur: …
Version: …
System / Système: …
Languages / Langues: …
Time zone / Fuseau: …
Screen / Écran: …
Cores · memory / Cœurs · mémoire: …
Graphics / Graphisme: …
Print no. / Empreinte nº: …
Issued / Délivré: …

P<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

Your browser is about to cross a border.

notabot reads what your browser declares, checks it for contradictions and stamps a verdict. No puzzle unless it has doubts, and then only a slider. Open source, front-end only.

Papers read
Cross-checked
Proof of work
AI officer

Nothing leaves this page. The AI verdict below is opt-in and uses your own model.

Everything your browser told this page

Read without a single permission prompt, and nothing was sent anywhere. Each line says what it reveals and how much it says about you; a reading that contradicts the rest is marked in red.

Reading your browser…

The inspector's report

One odd answer proves nothing: real people use VPNs, old laptops and privacy extensions. What gives a bot away is answers that contradict each other. Every rule below ran on your browser.

Run the check above to file the report.

Smart signals, in-house

What fingerprinting services sell on top of their open-source libraries, computed here from the same readings. With a server, they are sealed in the token and handed to your backend by /siteverify.

Simulate a bot

Change a copy of your own browser's signals the way a bot's would read, and see which rules notice. Nothing is sent: the scoring runs in this page.

Secondary inspection: ask an AI officer

The video's point: every captcha ends by sending the clues to a model that scores you. Here you pick the model and read exactly what it is sent. It only ever sees numbers, yes/no values and fixed words, never text your browser could have written, so a bot cannot talk its way in.

Which model My own key A proxy or Worker Ollama on this machine

Provider Model

API key Remember the key on this device

Sent to that provider alone. Forgotten when you leave, unless you tick the box: then kept on this device, encrypted in IndexedDB.

What the model is sent

The exact instructions and features, before anything is sent.

Appears once your browser has been read.

What it answered

—

Papers a page cannot read

Some of the strongest evidence never reaches JavaScript. Only a server sees it: the notabot middleware reads it where the platform gives it. Timestamps link to the video.

IP and network: A home internet provider or a datacentre (AWS, OVH, Hetzner), and whether its location agrees with your time zone. [03:44]
TCP fingerprint: The first SYN packet's TTL, window size and option order differ per operating system: a Windows user agent over a Linux stack gives itself away. [04:27]
TLS handshake (JA4): Cipher suites and extensions differ between Chrome's BoringSSL, Firefox's NSS and Python's OpenSSL. [05:01]
HTTP/2 settings: A second fingerprint of the client, layered under TLS. [05:55]
Behaviour at scale: Thousands of sessions on the same path with the same timings: invisible from one browser, obvious from the server. [08:39]
Agents that sign: AI agents and crawlers can sign their requests (Web Bot Auth): the server checks the signature against the operator's published key and knows who sent them. [12:44]

What the server would add

The rules only the middleware runs. Tried here on the headers this page can know about your browser (User-Agent, languages, client hints; the usual Accept and Sec-Fetch headers assumed), and marked server-only when they need what no page sees. notabot/middleware

Put it on your site

Four ways in, from one line to a server that checks every request.

One script tag

<form id="signup"> … </form>
<script type="module"
  src="https://maxgfr.github.io/notabot/cdn/notabot.js"
  data-form="#signup"></script>

Adds the check to the form and holds back the submission until it passes. The token lands in a hidden notabot-token field.

The npm package

npm install notabot

import { check, trackBehavior } from "notabot";
const behavior = trackBehavior();
const result = await check({ behavior });
result.verdict; // "human" | "unsure" | "bot"
result.rules.flags; // what tripped, and why

Every module is its own entry point: notabot/signals, /score, /behavior, /pow, /llm, /server, /widget.

A middleware on your server

import { createNotabot, notabotExpress } from "notabot/middleware";

const notabot = createNotabot({ hmacKey: process.env.NOTABOT_HMAC_KEY });
app.post("/signup", notabotExpress(notabot), (req, res) => {
  req.notabot.verdict; // token checked, bound, used once
});

Validates the request itself (headers a browser always sends, client hints, HTTP libraries, protocol, network) and the token: signed, bound to its browser and IP, used once. Express, Hono, or any Fetch server (Next.js, Bun, Workers).

With a Worker that signs

<notabot-check
  challenge-url="https://notabot.you.workers.dev/challenge"
  verify-url="https://notabot.you.workers.dev/verify">
</notabot-check>

POST /siteverify  secret=…&response=<token>
→ { "success": true, "verdict": "human", "score": 0.9 }

Signed puzzles, server-side signals, your model with your key, and a reCAPTCHA-style siteverify. examples/cloudflare-worker

What it catches, what it doesn't

No detector stops everyone. Here is where this one stands, and why the extra step is friction, not proof: free, locally run models pass 92.6 % of real reCAPTCHA image challenges.

Catches

Stealth layers injected in JavaScript: the natives they replace, the fresh iframes and workers they forget to patch.
Headless browsers out of the box: webdriver, HeadlessChrome brands, a software GPU, missing plugins.
Scripted HTTP clients: self-named user agents, missing browser headers, a TLS handshake no browser makes (on the server).
Camoufox as it is today: a fresh iframe with an empty Intl, an audio read failing with Firefox's privileged error. Camoufox

Does not catch alone

Browsers patched at the source that leave no seam: only their generated fingerprint's contradictions are left.
AI agents driving a real browser with a real GPU: their signals are a person's. FP-Agent
Human solving farms, paid to pass any challenge. Motoyama et al.

For those: the server's signals (JA4, headers, fingerprint velocity, a price per attempt) and agents that sign their requests (Web Bot Auth). Our own benchmark shows the gap: a headed Chrome with automation flags hidden passes every check here.

Sources: Robot Visions · Broken Gates · Halligan · FP-Inconsistent

What this cannot do

In the page alone, a verdict can be forged: a bot can skip the script or replay a good result. Enforcement needs the server half (the Worker), which checks the proof of work and signs the token.
Privacy tools (Brave, Firefox's fingerprinting protection, canvas blockers) change some readings. They count as weak evidence, never as a verdict on their own.
The AI officer gives a second opinion. A decisive rule, such as navigator.webdriver, is never argued away by it.
The slider and the targets both work from the keyboard, and behaviour never decides alone when there is no pointer. The extra step is friction for scripts; offer another way through for people who need it.