Shield
Edge Shield
A lightweight CAPTCHA alternative. Shield verifies visitors invisibly — no puzzles, no cookies, no tracking — and returns a 1–100 humanity score your application can act on. Free forever, with unlimited verifications.
Key Features
Invisible Verification
A proof-of-work challenge solved in a background thread. Real visitors almost never see anything — and never label traffic lights.
Humanity Score
Every verification carries a 1–100 score — 1 is confirmed automation, 100 a confirmed human. Allow, step up, redirect, or block on your own thresholds.
Privacy by Architecture
No cookies, no fingerprint database, no per-visitor storage. Only hourly aggregate counters are kept — GDPR and CCPA friendly by default.
Turnstile-Compatible
The siteverify response matches Cloudflare Turnstile's exactly, plus the score. Migrating is a URL and key swap.
Shadow Mode & Test Keys
Trial Shield in report-only mode on live traffic — nothing is ever blocked — and run CI against fixed test keys that never touch real state.
Offline Verification
Tokens are Ed25519-signed JWTs with a public JWKS endpoint — verify them locally with zero network calls when latency matters.
How It Works
The widget requests a challenge
A cryptographically signed challenge is issued by the Shield service. Difficulty adapts to risk signals — clean browsers get trivial work.
The browser solves it invisibly
A SHA-256 proof-of-work runs in a Web Worker — tens of milliseconds on a phone, with no impact on your Core Web Vitals.
A response token is minted
The solution plus coarse environment signals produce a signed, single-use token containing the humanity score. It's added to your form automatically.
The score refines as the visitor interacts
Verification runs at page load, before any real interaction. As the visitor types or moves the pointer, the widget sends a one-off summary of that interaction — aggregate statistics only, computed in the browser — and the token is re-minted with a behaviour-informed score. Human motor noise raises it; machine-perfect input lowers it.
Your server validates the token
One POST to siteverify with your secret key returns the verdict, hostname, and score. Tokens expire after 5 minutes and can be used exactly once.
Pricing
Shield's core protection is free forever — unlimited widgets, unlimited verifications, all three widget modes, and the humanity score included. There are no monthly assessment caps and no credit card required.
Get Started
Getting Started
Protect your first form in five minutes
Widget Modes
Managed, non-interactive, and invisible
Server-Side Validation
The siteverify API and humanity score
Migrating from Turnstile
A drop-in swap, step by step
Offline Verification
Verify tokens locally via JWKS
Testing & CI
Fixed test keys, deterministic behaviour