Synthetix Shield is invisible, privacy-first human verification for websites and apps. Stop spam, fake signups and credential stuffing — without making real customers squint at traffic lights.
Simulation only — real users normally see nothing at all.
Want the real thing? Get early access ↓
They frustrate real customers, leak data to ad networks, and modern AI solves them anyway.
Solver farms defeat mainstream CAPTCHAs for roughly a dollar per thousand. The lock costs attackers almost nothing.
Every puzzle is a checkout abandoned and a signup never finished. Friction is a tax paid only by humans.
Free CAPTCHAs aren't free. Your visitors' behaviour gets fed into someone else's advertising graph.
Difficulty scales with suspicion. Over 95% of genuine visitors are never shown anything.
The moment a page loads, Shield reads device, behavioural and network signals — mouse motion, timing, automation traces, IP reputation. No cookies. No PII.
Our engine returns a score in under 100 ms. Confident humans pass invisibly. Uncertain sessions get proof-of-work. Only genuine threats meet a real challenge.
Shield issues a signed, single-use token bound to your domain. Your backend confirms it with one API call. Replays are rejected automatically.
Most visitors never see a widget, a checkbox or a puzzle. Verification finishes before the page settles.
Trivial for one browser, ruinous at a million solves a day. We make attacks uneconomic rather than merely annoying.
Humans have jitter, tremor and hesitation. Bots draw perfect curves and fill twelve fields in forty milliseconds.
Headless Chrome, Puppeteer, Playwright, Selenium and patched anti-detect browsers all leave fingerprints.
Traffic processed in-region, built for DPDP Act compliance. EU and US regions available per site.
No tracking cookies, no cross-site ad profiling, no consent banner triggered by us.
WCAG 2.2 AA. Full keyboard path, screen-reader labels, audio alternative, reduced-motion support.
Paranoid on checkout and signup. Relaxed on the newsletter box. One key, different rules.
See what was blocked, from where, and what it would have cost you. Attack forensics included.
A reCAPTCHA-compatible verify endpoint. For most sites, switching is a URL swap and ten minutes.
The same risk engine protects your mobile apps and raw API endpoints, not just browser forms.
Legitimate AI agents are coming. Choose per endpoint whether to allow, meter, or block them.
<!-- 1. Front end -->
<script src="https://cdn.synthetixshield.com/v1/shield.js" async defer></script>
<div class="synthetix-shield" data-sitekey="sx_live_a1b2c3"></div>
// 2. Back end (Node)
const r = await fetch('https://api.synthetixshield.com/v1/siteverify', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
secret: process.env.SHIELD_SECRET,
token: req.body['synthetix-shield-response']
})
});
const { success, score } = await r.json();
if (!success) return res.status(403).send('Bot detected');Not "free but weak" and not "₹4 lakh a year, talk to sales."
Overage ₹40 per 1,000. Annual billing saves two months. Prices indicative during early access.
We're onboarding a small group of design partners. Early users get free Pro for twelve months and direct input on the roadmap.
We'll email you a 6-digit code to confirm it's really you.
Didn't get it? Check spam, or
Your early access ID — we've emailed a copy.
Check your inbox for confirmation, your perks, and links to everything.
Reply to that email any time — a human reads it.
Not yet. We're in active development and onboarding design partners. Join the waitlist and we'll contact you before public launch. We'd rather tell you this plainly than sell you vapour.
Three ways. We don't feed your visitors' behaviour into an advertising graph. We process data in your chosen region, including India for DPDP compliance. And we escalate by risk, so real customers almost never see friction — instead of everyone clicking traffic lights.
Any single defence can be beaten — anyone claiming otherwise is selling something. Shield layers proof-of-work, behavioural analysis, device fingerprinting and network reputation so that defeating all of them at scale costs more than the attack earns. We're building an economic filter, not an unbreakable puzzle.
By default Shield fails open — verification is skipped rather than blocking your users. Your login page will never go down because ours did. You can switch to fail-closed for high-security flows.
We provide a reCAPTCHA-compatible verify endpoint, so for most sites it's swapping a script URL and an API endpoint. Typically under an hour. Our team will do it for you on paid plans.
Signals needed to distinguish humans from bots: coarse device and browser characteristics, interaction timing, and network reputation. No tracking cookies, no cross-site profiling, no selling data — ever. IPs are hashed with a rotating salt and raw telemetry expires after 30 days.
Synthetix Digitals — we build software products and digital platforms. Shield came out of protecting our own clients' forms and deciding the existing options weren't good enough.