Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA

A new open-source project introduces a gesture-dynamics CAPTCHA designed as a drop-in replacement for reCAPTCHA. Instead of forcing users to identify buses or traffic lights, the system asks visitors to draw an arbitrary gesture lasting roughly ten seconds.

The core idea is to classify motor behavior rather than visual content. Eight statistical features, including velocity variance, pause entropy, rhythm irregularity, and correction count, are extracted from the gesture. A local gradient-boosting model handles clear cases in milliseconds, while an LLM is invoked only for uncertain borderline decisions.

The widget is delivered inside an iframe served from the vendor origin. This architecture avoids CORS restrictions and Origin-based bot filters that would arise if the client page called the API directly. Each integration uses a public key bound to an allow-list of domains and a secret key kept on the customer server for token verification.

Privacy protections are explicit: raw coordinates never leave the browser, no image datasets are collected, and no biometric templates are stored. The resulting token carries no user identity and expires after 120 seconds. Because no Google services are involved, sites avoid both data-transfer concerns under GDPR and the need for additional cookie banners.

Integration requires two lines on the client side and a single server-side verification call modeled after reCAPTCHA. On success the loader injects a hidden field named aptogon-response; the backend then posts the token to the verification endpoint using the secret key.

The project acknowledges its limitations. A motivated attacker could eventually imitate human dynamics, and the widget alone does not stop distributed floods through residential proxies. Accessibility accommodations for motor impairments are included, with ongoing collection of feedback to refine the models.

In the Russian market the solution positions itself against Yandex SmartCaptcha, targeting developers who need self-serve privacy controls and cannot rely on reCAPTCHA due to availability or regulatory constraints. Source code, documentation, and live demos are available under the AGPL-3.0 license with a free tier of one thousand verifications per month.