Skriza Shield
A captcha that stores nothing on the device.
Shield checks whether a request comes from a human without setting a cookie, building a device fingerprint or storing an IP address in the clear. We built it because we wanted Google reCAPTCHA off our own sign-up; since July 2026 it runs there in production.
Try it first, read afterwards
This is the real challenge, not a video of one. It only appears when the invisible check finds something off — on most requests none of what you see here happens. What is judged is how you rotate, not whether the final angle is exact.
Open the storage tab of your developer tools while you do it. There will be exactly as much in it afterwards as before: nothing.
How a check runs
Three steps, of which most visitors notice only the first — and that only because a tick appears.
Invisible check
The browser solves a small proof-of-work and reports characteristics typical of automated browsers — each already reduced in the browser to yes/no or a rounded number. For a reader that is a few milliseconds; for a script making thousands of requests it is real compute.
Only on suspicion: interactive challenge
If something does not add up, the rotate task appears. What counts is the path of the movement, not the end position — a mouse that travels to the target in a perfect line is not a good sign. Only aggregate metrics are transmitted, no coordinates and no motion trace.
Verdict to your backend
The result is a single-use token valid for about five minutes. Your server exchanges it for the verdict: risk score, action and a few machine-readable reasons. What follows is your decision — Shield does not suspend your account, it answers a question.
What Shield processes — and what it does not
The left column is the complete list. If something you expected is missing from it, that is not because we left it out to look good.
Processed
- IP address, only as a non-reversible HMAC hash — the key for short-lived counters, never stored in the clear
- Country and network operator (ASN), derived from the IP, cached briefly
- Automation indicators such as navigator.webdriver, as booleans
- Environment consistency: plugin and language counts, cores, memory class, window dimensions, timezone offset
- Graphics hints as yes/no: software renderer, WebGL present
- Aggregate interaction metrics while the widget is visible
- Counters per IP hash over checks, failures and blocks
Not processed
- No cookie, no localStorage, no sessionStorage, no IndexedDB, no cache-based identifier
- No canvas image, no font hashing, no renderer string — no recognisable fingerprint
- No mouse coordinates and no motion trace
- No plaintext IP in the database
- No content of the form being protected
- No link to an advertising profile, no sharing with third parties
- No transfer to a third country
The legal position, honestly sorted
The usual sales line is: reCAPTCHA is illegal, buy ours. That was always too simple, and since April 2026 it is no longer true.
What changed for reCAPTCHA
Since 2 April 2026 Google provides reCAPTCHA contractually as an Art. 28 GDPR processor rather than as its own controller. That makes use on the basis of legitimate interests considerably better secured than during the years of warning letters that followed the 2022 judgment of the Munich Regional Court. Anyone selling you a page that still says otherwise has not checked in over a year.
What stays different anyway
The role question is not the only one. § 25 TDDDG turns on whether information is stored on or read from terminal equipment — regardless of who the controller is. Whoever writes something there has to argue it is strictly necessary, and carries the risk of a different assessment. Shield writes nothing, so the question does not arise. On top of that: no data transfer to the US, and therefore no Standard Contractual Clauses to defend.
Automated decisions (Art. 22 GDPR)
A bot protection decides automatically, and a block can engage Art. 22 GDPR — regulators cite freezing an account as an example of a significant effect. We write that down rather than glossing over it: normally Shield only supplies a verdict and you decide. Where Shield blocks itself, it applies only to the protected endpoint, expires by itself, and leads to an appeal page where a person can reverse the decision — the safeguard Art. 22(3) GDPR requires.
What you still have to do as an operator
Enter into a processing agreement, name the processing in your own privacy policy, document the legitimate interest and add it to your record of processing activities. Our notice is written so you can link it or copy sections of it. There is no captcha that takes this work off you entirely, and anyone claiming otherwise is selling you a risk.
Integration
Two lines in the form, one call in the backend. The shape deliberately mirrors Cloudflare Turnstile, so switching does not mean rewriting your form.
In the page, where the widget should sit:
<div class="skriza-shield" data-sitekey="skz_site_..."></div>
<script src="https://skriza.com/api/shield/embed" async defer></script>In the backend, against the submitted token:
curl -X POST https://skriza.com/api/shield/siteverify \
-d secret=$SKRIZA_SHIELD_SECRET \
-d response=$FORM[skriza-shield-response]Response on success:
{ "success": true, "action": "signup", "score": 4 }You get the site key and secret in the developer portal. The secret is shown exactly once.
Where Shield is not the right choice
So you do not find out after integrating.
- If you need detection trained on billions of requests a day: Google and Cloudflare see more attack traffic than we do, and that lead is real. Shield reliably stops scripts, bulk sign-ups and form spam; against a paid human solving service no captcha helps, including theirs.
- If your users have JavaScript disabled: without a script there is no proof-of-work and no check. Keep another route open for that case.
- If you need an audit certificate: we do not have one. What we have is a published description of the processing and behaviour you can inspect in the browser.
- If the rotate task is not operable for your user group: the invisible check needs no motor task, but keep an accessible alternative available for when the challenge does fire.
Frequently asked questions
Including the ones that do not flatter us.
Do I need a cookie banner for Shield?
No. § 25(1) TDDDG presupposes that information is stored on or read from terminal equipment. Shield does neither, so the provision is not engaged and there is nothing to consent to. We do not need to rely on the strictly-necessary exemption for this.
Can Shield recognise me across several websites?
There is a cross-site counter: someone blocked on one Shield-protected site is asked for a challenge sooner on another. All that is stored for it is a number against an IP hash in a rolling 24-hour window — not which sites were visited. No profile comes out of that, but it is more than nothing, which is why it is here and not in the small print. Switchable off per site.
Is it as good as reCAPTCHA?
On detection, not in every respect — see the section above on where Shield does not fit. On data protection yes, and that is checkable rather than claimed: open the storage tab, open the network tab, look.
What happens if Skriza goes down?
Then no token arrives, and your form has to decide what to do about it. We suggest failing open for sign-ins and failing closed for registrations — but that is your call, and you should make it before it happens. Skriza is a one-person project; we will not give an availability promise we cannot keep.
What does it cost?
Nothing during the closed beta. There is no price list yet, and we are not inventing one here.
Create a site key
Shield is part of Skriza's developer portal. There you add a website, get a site key and secret, set the sensitivity, and see the verified and blocked figures.