# TapHuman

> TapHuman is a privacy-first, WCAG 2.1 AA-accessible human-verification (CAPTCHA alternative) platform by Oops Games LLC. It replaces image-grid CAPTCHAs with 2–5 second playable HTML5 microgames, verified server-side with HMAC-SHA256 signed tokens. No behavioral tracking, no cross-site cookies, no data resale. Free tier: 1,000 verified solves per month; only cryptographically verified human solves are ever billed — bot traffic is free.

TapHuman (formerly conversion.business) is designed for e-commerce checkouts, login/signup forms, fintech onboarding, communities, and SaaS trials where traditional CAPTCHAs cause a 3–5% conversion drop. Integration takes three steps: embed an iframe widget, listen for a signed `postMessage` solve event, and verify the HMAC-SHA256 signature on your server. No SDK library is required. Verification is backed by layered security: server-seeded PRNG game state, SHA-256 proof-of-work, solve-speed limits, single-use tokens with a 5-minute expiry, replay caching, and per-workspace domain allowlists. An accessible bypass gateway serves screen-reader and motor-impaired users, keeping the entire flow WCAG 2.1 AA conformant.

Key facts:
- Product: gamified human verification / CAPTCHA replacement (B2B SaaS)
- Company: Oops Games LLC, headquartered in Kansas City, KS (United States); founders Andy Pace and Kate Papilio-Davis
- Privacy: no mouse-movement tracking, no fingerprint-based ad profiles, IPs salted and hashed daily; suitable for GDPR/CCPA-strict jurisdictions where Google reCAPTCHA has drawn CNIL scrutiny
- Accessibility: WCAG 2.1 AA compliant, European Accessibility Act ready
- Pricing: freemium — 1,000 verified solves/month free; Pro at $0.009 per verified solve (~$9 per 1,000) with no flat fees or contracts; "God Tier" early-adopter program gives the first 100 sites 100,000 solves/month free forever (code EARLY_ADOPTER_2026); usage billed only on successful HMAC-verified solves
- Sign-up / account portal: https://conversion.business/login (billing and API keys are managed in the dashboard)

## Product

- [How it works](https://taphuman.io/product/how-it-works): Architecture and verification flow — iframe embed, signed solve event, server-side HMAC check
- [Security model](https://taphuman.io/product/security): Cryptographic signing, replay resistance, proof-of-work, seeded PRNG game state
- [Privacy](https://taphuman.io/product/privacy): Tracker-free verification, GDPR/CCPA posture, data minimization guarantees
- [Accessibility](https://taphuman.io/product/accessibility): WCAG 2.1 AA compliance and the accessible bypass gateway
- [Pricing](https://taphuman.io/pricing): Free tier and usage-based paid plans — only verified human solves count
- [Trust Center](https://taphuman.io/trust/trust-center): Compliance posture, data handling, and security practices
- [Changelog](https://taphuman.io/changelog): Product release history

## Documentation

- [Developer quickstart](https://taphuman.io/docs/quickstart): Full integration guide — iframe embed, postMessage listener, Node.js/Python HMAC verification, API endpoints, error codes, WordPress plugin, React component

## Use cases

- [E-commerce](https://taphuman.io/use-cases/ecommerce): Stop checkout bots without a conversion tax
- [Fintech](https://taphuman.io/use-cases/fintech): Compliant, accessible verification for regulated onboarding
- [Communities](https://taphuman.io/use-cases/communities): Block fake signups and spam registrations
- [SaaS](https://taphuman.io/use-cases/saas): Protect free trials and login endpoints

## Comparisons

- [Compare overview](https://taphuman.io/compare): Feature matrices vs. major CAPTCHA providers
- [TapHuman vs Google reCAPTCHA](https://taphuman.io/compare/taphuman-vs-google-recaptcha): Privacy-first verification vs. Google's tracking layer
- [TapHuman vs Cloudflare Turnstile](https://taphuman.io/compare/taphuman-vs-cloudflare-turnstile): Infrastructure-agnostic delight vs. CDN-tied invisibility
- [TapHuman vs hCaptcha](https://taphuman.io/compare/taphuman-vs-hcaptcha): Genuine delight vs. rebranded image grids
- [TapHuman vs Arkose Labs](https://taphuman.io/compare/taphuman-vs-arkose-labs): Self-serve game-based security vs. enterprise-only contracts
- [TapHuman vs GeeTest](https://taphuman.io/compare/geetest): Cryptographic game security vs. solver-farm-vulnerable ML puzzles
- [TapHuman vs Friendly Captcha](https://taphuman.io/compare/taphuman-vs-friendly-captcha): Playful verification vs. a progress bar
- [TapHuman vs ALTCHA](https://taphuman.io/compare/taphuman-vs-altcha): Managed game security vs. open-source proof-of-work
- [TapHuman vs AWS WAF CAPTCHA](https://taphuman.io/compare/aws-waf-captcha): Cloud-agnostic game security vs. infrastructure-bundled image grids

## Blog

- [The Solver Industry Built a Business Breaking GeeTest. Here's Why TapHuman Is Different.](https://taphuman.io/blog/geetest-vs-taphuman): GeeTest pioneered interactive CAPTCHAs in 2012. Today commercial solver APIs defeat every challenge type it offers. Here's why the model — not the execution — is the problem, and how cryptographic proof changes the equation.
- [How TapHuman Handles AI Agents — and Why Cryptographic Proof Is a Better Answer Than ML Scoring](https://taphuman.io/blog/how-taphuman-handles-ai-agents): As AI agents proliferate, verification vendors are racing to offer 'agent trust management.' TapHuman's cryptographic proof model has a structurally sounder answer — here's why inspectable proof beats black-box ML scoring.
- [The Mouse Movement You Didn't Know Was Illegal](https://taphuman.io/blog/gdpr-mouse-tracking-privacy-law): reCAPTCHA v3's mouse-movement behavioral tracking has been flagged by EU regulators (CNIL) and California's CPPA as requiring prior consent. Here's what the law says and how to avoid the exposure.
- [You Trained the Bot That Beat Your CAPTCHA](https://taphuman.io/blog/you-trained-the-bot-that-beat-your-captcha): reCAPTCHA image challenges trained the AI that now bypasses them. hCaptcha sells your users' labor to AI companies. Here's the full story of how the CAPTCHA industry failed — and what cryptographic human verification looks like instead.
- [Why CAPTCHA Kills Conversions (And What to Do About It)](https://taphuman.io/blog/why-captcha-kills-conversions): Stanford and UC Irvine data show traditional CAPTCHAs cost 9–26 seconds and 3–5% of conversions. Learn how gamified verification eliminates the security time tax.
- [The GDPR Problem with Google reCAPTCHA: What Developers Need to Know](https://taphuman.io/blog/recaptcha-gdpr-privacy-problem): CNIL rulings say reCAPTCHA requires prior consent in the EU. Learn why cross-site tracking creates GDPR liability and how TapHuman's architecture avoids it entirely.
- [How Traditional CAPTCHAs Fail WCAG 2.1 AA — And What It Costs Your Business](https://taphuman.io/blog/wcag-captcha-accessibility): WebAIM ranks CAPTCHA the #1 barrier for screen-reader users. Learn the WCAG 2.1 AA failures, the lawsuit data, and how TapHuman delivers accessible verification.
- [The Psychology Behind Gamified Verification: Why Play Beats Puzzles](https://taphuman.io/blog/gamified-verification-science): Flow theory, the peak-end rule, and the Fogg model explain why 3-second microgames outperform puzzles at the point of conversion.
- [Server-Side Verification: Why Client-Only CAPTCHA Is Security Theater](https://taphuman.io/blog/server-side-verification-security): A technical deep dive into HMAC-SHA256 signed tokens, single-use replay resistance, and why client-only CAPTCHA verification is security theater.
- [Gamified CAPTCHAs Are the Future of Human Verification — Here's the Evidence](https://taphuman.io/blog/gamified-captchas-are-the-future): Bots solve image CAPTCHAs at 99%+ accuracy while bot traffic passes 50% of the web. The academic, commercial, and regulatory evidence for game-based verification.
- [From Annoyance to Micro-Joy: Redesigning the Emotional Contract of Web Security](https://taphuman.io/blog/micro-joy-security-ux): Explore how replacing security annoyance with micro-joy increases task completion and lowers abandonment.
- [The End of the Image Grid: Why Traditional CAPTCHAs Have No Future](https://taphuman.io/blog/end-of-the-image-grid): USENIX-published research shows bots beat humans at every legacy CAPTCHA type. Why the image grid is finished and what replaces it.
- [How Microgames Stop Sophisticated Bots That reCAPTCHA Can't](https://taphuman.io/blog/how-microgames-stop-sophisticated-bots): Technical explainer: why motor complexity plus single-use HMAC tokens defeat solver farms, residential proxies, and credential stuffing that fool invisible scoring.
- [The 7 Best reCAPTCHA Alternatives in 2026 (Honestly Compared)](https://taphuman.io/blog/best-recaptcha-alternatives): Honest comparison of the best reCAPTCHA alternatives: TapHuman, Cloudflare Turnstile, hCaptcha, Friendly Captcha, GeeTest, Arkose Labs, and ALTCHA — privacy, accessibility, and bot resistance compared.

## Whitepapers

- [Frictionless Security at Scale](https://taphuman.io/resources/whitepapers/frictionless-security-at-scale): Architecting a privacy-first, WCAG-compliant human verification primitive for the modern enterprise web.
- [Solving the Conversion Crisis: How Gamification Eliminates the Security Time Tax](https://taphuman.io/resources/whitepapers/solving-the-conversion-crisis): As bots become more sophisticated, digital security has historically come at a steep price: user experience. The traditional visual CAPTCHA, once a necessary evil, has become a significant point of friction that actively damages conversion rates.
- [The Gamification Imperative: Why Interactive Verification Is the Future of Web Security](https://taphuman.io/resources/whitepapers/gamification-imperative): A strategic analysis of the forces driving the shift from passive verification to active, game-based human confirmation — and what it means for developers, security teams, and compliance officers.
- [Bot Economics 2025: The True Cost of Automated Abuse and the Case for Frictionless Defense](https://taphuman.io/resources/whitepapers/bot-economics-2025): A framework for quantifying the full cost of bot traffic — direct revenue loss, infrastructure overhead, data quality degradation, and compliance risk.

## Company

- [About TapHuman](https://taphuman.io/company/about): Mission, convictions, company details, and founder profiles
- [Contact](https://taphuman.io/company/contact): Sales, support, enterprise, and security inquiries

## Optional

- [Full content for LLMs](https://taphuman.io/llms-full.txt): Complete text of all blog posts, whitepapers, and competitor comparisons

- [Terms of Service](https://taphuman.io/legal/terms)
- [Privacy Policy](https://taphuman.io/legal/privacy)
- [Accessibility Statement](https://taphuman.io/legal/accessibility-statement)
- [Resources hub](https://taphuman.io/resources)
- [Blog index](https://taphuman.io/blog)
- [Whitepapers index](https://taphuman.io/resources/whitepapers)