Every public form attracts spam. The usual answer is a CAPTCHA: a check, run by another company, that decides whether the visitor is a person. We chose not to use any of them. Here is why, and what every Agent002 form does instead.

The CAPTCHAs most sites use

  • Google reCAPTCHA is the best known: the “I’m not a robot” box, the grids of traffic lights, and an invisible version that scores every visitor. It runs Google’s code in the visitor’s browser and sets a cookie that Google’s documentation says is for its “risk analysis”. In 2022 France’s data protection authority, the CNIL, told the Ministry of the Interior that reCAPTCHA on one of its forms still needed consent, because the data it collects isn’t used only to secure the site.
  • hCaptcha is often picked as the more private alternative. It still shows picture puzzles. People who can’t solve them get a text challenge if the site has turned that on, or can register with an email address for a cookie that lets them through.
  • Cloudflare Turnstile asks most people nothing: it checks the browser in the background. To do that it sends Cloudflare signals such as the IP address, a fingerprint of the connection and the browser’s user agent, which Cloudflare also uses, as a controller in its own right, to improve Turnstile.
  • Questions like “What is 3 + 4?” need no other company, but a simple script or any AI chatbot answers them, and they’re still one more thing for people to get past.

What they cost a form owner

  • Privacy. With a hosted CAPTCHA, the people filling in your form are checked by a company they never chose, and details about their visit leave your site. Whether that needs their consent is a question you then have to answer, before a contact form.
  • People. Picture puzzles are slow for everyone and hard for people who are blind, have low vision or dyslexia. A form that only some people can send isn’t doing its job.
  • Less than it seems. Bots have caught up with the puzzles. In 2024 researchers at ETH Zurich solved every reCAPTCHA picture challenge they were shown with an ordinary image-recognition model. A puzzle that stops people more reliably than bots is the wrong way round.
  • Control. Your form depends on a service you can’t inspect, run by another company on its own terms, which can change.

What we do instead: Agent002 Silent Check

Every Agent002 form, on every plan, is protected by Silent Check. People never see it. Bots meet six checks:

  1. A puzzle the browser solves. When the form opens, our server hands the browser a small maths puzzle: find the one number, among up to 100,000, that gives a known SHA-256 fingerprint. A phone solves it in well under a second, usually while the person is still reading the first question. For one person that’s nothing; for a bot sending thousands of forms, every one costs real computing time.
  2. Puzzles that work once. Each puzzle is signed by our server, belongs to one form, expires after 20 minutes and is accepted only once.
  3. A clock bots can’t rush. Anything sent within three seconds of the form opening is set aside: nobody fills in a form that quickly. Our own page simply waits out those seconds.
  4. A field only bots see. Every form has a hidden field that people never see and screen readers skip. Simple bots fill in every box they find, and give themselves away.
  5. Harder under attack. When a form suddenly gets far more answers than usual, its puzzles become four, then ten times harder for a while. People barely notice, because the work happens while they type.
  6. A limit for each connection. No connection can send more than 20 answers a minute.

A bot caught by the hidden field or the clock gets an ordinary “thank you”, so it learns nothing. What it sent isn’t saved and never reaches your inbox, your Google Sheet or your webhooks.

The idea of making the browser do a little work isn’t ours alone. Proof-of-work services such as Friendly Captcha and the open-source ALTCHA use it too, and they’re a good choice if you build your own site. In Agent002 it’s simply built in, with nothing to set up.

What Silent Check doesn’t do

No cookie is set and nothing is stored in the browser. Nothing is loaded from another company: the puzzle comes from our servers in Germany and goes back to them. Nobody is asked to click on pictures, so nobody can fail. The IP address is used in memory for about a minute to slow down floods, and isn’t kept.

No spam filter is perfect. A person paid to fill in forms by hand looks like anyone else, and a determined sender with enough computers can still get through. When that happens, the harder puzzles make each answer more expensive, and we keep improving the checks. So far Silent Check has kept forms clean without asking anything of the people who fill them in.

If your forms use a CAPTCHA today and you want to compare, try one of ours: there’s nothing to click.