Does a bot check watch how you move?
Some checks never show a box. They score how the page is used: whether each click came from a device or a script, and whether the pointer moves like a hand. For almost every person this part passes. When it does not, the cause is a tool, not your hand.
Every input event in a browser carries a flag the page cannot fake: isTrusted. It is true when the event came from a real device (a mouse, a trackpad, a finger, a key) and false when a script made it. An auto-clicker extension, a macro tool or a form-filler that types for you produces events with the flag set to false.
Checks also look at the shape of movement. A hand speeds up and slows down, overshoots and corrects, pauses before it clicks. A script moving a pointer in a straight line at a steady speed does none of that. These are summaries of rhythm, not records of what you did.
What this page measured
From the moment the reading loads, this page keeps the same kind of summary: how many pointer moves, how fast and how unevenly, how often the direction changes, how many key presses and how far apart, and whether any event was marked as made by a script. It never records where the pointer was, which keys were pressed or anything you typed.
The input-rhythm row fires on two things only: events marked as made by script, and thirty or more pointer moves at an almost constant speed. Anything a person does with a mouse, a trackpad, a touch screen or a keyboard passes.
Keyboard, touch and accessibility tools
Using only the keyboard, or only touch, is ordinary. A check that reads behaviour does not expect a mouse; it expects input that came from a device. Screen readers and switch access produce trusted events.
Tools that act for you are different. Voice-control software, remote-desktop sessions and some accessibility helpers can produce events a browser marks as made by script. If you rely on one and keep getting challenged, that is worth knowing: it is not you, and the fix is to let the site’s accessibility option or audio challenge take over rather than to change the tool you need.
Input rhythm
Clicks or key presses on the page came from a script, not from your hands.
- Turn off auto-clickers, macro tools and form-fillers on the site that keeps challenging you. They create input the browser marks as not made by a device.
- If you use a remote-desktop or accessibility tool that types for you, try once without it to see if the challenges stop.
- If this row is clear, your mouse is not the problem. No check can tell your hand from anyone else's.
A row's place on your reading is one multiplication, and both halves of it are published. Neither half is a measurement.
- Surprisal −log₂ of an assumed probability of 0.0050 for “input events on the page were made by script”
- 7.64 bits
- Challenge weight Input events not made by a device — how much a bot check is judged to act on it
- 0.70
- Rank The product. It orders the rows and nothing else.
- 5.35
Why that assumption
People do not usually run auto-clickers or macro tools on a page like this one. Assumed very low, which makes the row rank high when it does fire.
Why that weight
Browsers mark every event a script creates as untrusted, and invisible challenges read that mark along with how the pointer moves. A click no hand made is the plainest behaviour signal there is.
We think this one is probably wrong
Probably too low for scripted events and too high for the constant-speed test, which a steady trackpad swipe can come close to.
Every assumption, with its number → · Every weight, and what is deliberately not measured →
Questions about the “Input rhythm” row
- Can a website tell I’m not a bot from my mouse movements?
- It can tell that input came from a device and moved like a hand, and many invisible checks use that as one input among several. It cannot tell your hand from anyone else’s, and good movement does not outweigh a contradiction or a bad address.
- Does using an auto-clicker or autofill cause captchas?
- Tools that create clicks or keystrokes in the page do, because the browser marks those events as made by a script. The password manager built into your browser does not; it fills fields without faking key presses. Third-party form-fillers vary.
- Is my typing recorded?
- Not here. This site counts key presses and measures the time between them, and never records which keys were pressed or any text. The privacy page lists everything the site records.
READ AT PRIOR TABLE ED. 1.0.0 · 2026-10-13 · ASSUMED, NOT MEASURED
The rank is taken against 15 written assumptions about how common each value is and 16 written weights about how much each one matters. 9 of them we think are probably wrong. Real counts from the browsers these sites have read appear beside a row, never inside its rank. Read the assumptions →
The rows you cannot fix from a settings page
A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.
Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.
Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.
Free · AGPL-3.0 · github.com/zhom/donutbrowser