Know there is a real person behind the button.
One line of code to add full-fledged liveness verification to your website. Stop fake signups, fake reviews and bot accounts.
100 verifications a month · No credit card · No photos stored
Confirming a live person
- They press your button
- Camera opens
- Liveness check runs
- Certainty established
- Verified live person
Three seconds for your user. One line of code for you.
No SDK. No complicated integration. No camera code to build.
They click your button
Your own button, your own wording, wherever the action that matters lives. Nothing else on the page changes, and your site never asks for camera permission.
DeSpoof checks for a live person
A few seconds of guided movement, spoken out loud, with a clear signal on screen. The camera opens in a frame on our domain and the result is judged on our servers, never in their browser.
They continue
Camera off, frame closed, straight back to what they were doing. Your server gets a short-lived code it can confirm, and you decide what happens next.
Then mark the button you want protected with data-despoof="verify", and confirm the code from your server. That is the entire integration.
Put DeSpoof where fake accounts cost you money.
A bot can fill in your form. It cannot turn its head.
Fake signups
Scripts can fill forms. They cannot turn their head.
Fake reviews
Make every review come from a live person.
Bulk accounts
Make every new account require a real person.
Stolen password resets
Add a person to the step attackers go for most.
Spam messages
Verify people before they can contact others.
Trial farming
Free trials stop being a renewable resource.
No photos. No face data. Nothing to leak.
The camera is used for the liveness check and then discarded.
No photos
The camera is used for the check and then discarded. Nothing is uploaded, nothing is saved, and there is no thumbnail in anyone's dashboard.
No face data
No videos, no face maps, no templates. What reaches us is a few numbers about movement and timing, and nothing that could be matched against a person anywhere else.
Nothing to leak
If we were breached tomorrow your users would not be exposed, because we never held anything that identifies them.
CAPTCHA proves the browser is behaving. DeSpoof proves a person is there.
Use CAPTCHA everywhere. Use DeSpoof on the actions that matter.
See the full comparison
Exactly what it catches, and what it does not.
Most of this industry answers that with a percentage nobody can check. Here is the mechanism instead.
Stops scripts, completely
A script has no camera and no face. There is nothing for it to submit.
Stops printed photos and still images
A photo held up to the camera does not move the way a face does. It fails on natural movement before it fails on anything else.
Stops replayed recordings
The challenge is built fresh for every attempt and never repeats in the same shape. A recording of a check that passed is no use the next time, because the next time asks for something else.
Stops rushed and robotic responses
Every stage is timed on our server, not in the browser. A response faster than a human reaction, or one with no natural variation in it, is rejected.
Does not stop a person you paid
Someone sitting at a camera will pass, once, for each account they are paid to create. That is the point. It puts a human cost on every fake account rather than removing the possibility.
Not identity, not age
It confirms a person is there. Not who they are, not how old they are, not who they are acting for. Use it alongside your other controls, not instead of them.
You set the rules. You see what happened. You never see a face.
One screen holds everything. Nothing you change here needs your website touched again.
- You decide how certain you need to be Three levels of assurance. Turn it up when abuse spikes, down when real people start failing.
- You choose how many checks run One to five per attempt, from the families you switch on. The challenge is built fresh every time.
- You cap how often one person can try A cooldown, an hourly limit and a daily limit, counted per connection, so nobody can burn through your month.
- You list the websites it may run on Your tag works nowhere else, so it cannot be lifted and spent by someone else.
- You see every attempt The time, the connection, the browser, the checks that ran and the certainty behind the result.
- You never see a photograph Because none was taken. There is nothing in here that could identify anyone who used your site.
Add it in minutes.
One script. One attribute on your button. Done. No SDK, no API to learn, no camera code. Your server makes one call to find out what happened.
<!-- anywhere before </body> --> <script src="https://widget.despoof.com/widget_v1.js" data-app="dsp_live_8x2kq4m"></script> <!-- your own button, styled however you like --> <button data-despoof="verify" data-despoof-ref="signup" data-despoof-then="submit"> Create account </button>
That is the whole front end. data-despoof-then="submit" posts the form once the check passes.
// Browser side. For your interface only. DeSpoof.on('verified', function (e) { fetch('/despoof/confirm', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code: e.code, reference: e.reference }) }); }); DeSpoof.on('failed', function (e) { showMessage(e.reason); });
Or set a callback URL in your dashboard and skip this entirely.
// Your server. The only result worth trusting. const r = await fetch('https://widget.despoof.com/verify.html', { method: 'POST', headers: { 'Authorization': 'Bearer ' + DESPOOF_SECRET, 'Content-Type': 'application/json' }, body: JSON.stringify({ code }) }); const check = await r.json(); if (!check.success) return deny(check.error); allowSignup();
A code works once and dies in two minutes. Nothing on your page is worth forging.
{
"success": true,
"app": "dsp_live_8x2kq4m",
"reference": "signup",
"score": 0.94,
"checks": ["turn_left", "blink"],
"verified_at": "2026-08-07T04:19:52Z",
"duration_ms": 5140,
"ip": "203.0.113.24",
"browser": "Chrome 141",
"os": "macOS 15.3",
"device": "desktop"
}
Keep this next to your own record. It proves a person was there, and says nothing about who.
Start free. Upgrade when you need more.
Only successful verifications count.
Basic
- 2 websites
- 1,000 verifications
- Every control included
Go over and we email you. Nothing switches off mid-month.
What people ask before they paste the tag.
Do you keep a photo of anyone?
No. No image, no video, no face map, no thumbnail, at any point. The camera view is measured on the device. What reaches us is numbers about movement and timing.
That is a hard limit on the product. It tells you a person followed instructions. It cannot tell you who they were, and it cannot be turned into a way of finding out.
Could someone fake the result on their own page?
No, and that is why your server makes one call. The browser never gets a pass or a fail it could forge. It gets a code, and the code means nothing until your server exchanges it with us.
The check runs in a frame on our domain, the judgement happens on our servers, and the code is single use, tied to your website, and dead in two minutes.
What stops someone burning through my monthly allowance?
Three things. Your widget only runs on websites you list, so the tag cannot be lifted and used elsewhere. Attempts are throttled per connection, with a cooldown and hourly and daily caps you set. And only successful verifications count.
What about people who cannot use a camera?
Some have no camera, some refuse permission, some are in a dark room. Decide the way through before you go live: hold the action for review, fall back to email, or let it pass and flag it.
The widget tells you why it did not finish, so you can tell a refused camera apart from a failed check.
Do I need to tell my users anything?
Yes. Camera use has to be explained and agreed to, and your privacy policy needs a line about it. The widget shows a short consent line before the camera opens, and you write the wording in your dashboard.
Which browsers and devices work?
Any current browser with a camera, desktop or mobile. If your pages send a restrictive permissions policy header, add camera=(self "https://widget.despoof.com") to it, or the browser will block the camera inside the frame.
Can I use it with CAPTCHA?
Yes, and plenty of sites should. CAPTCHA is cheap enough to leave on every page. Put DeSpoof on the handful of buttons where a fake account actually costs you money.
Put a real person behind every important action.
Start free. No credit card. No photos stored.
Start free