# Bot-check lab

> What can a website tell about the browser that opened it?

Our own probes and the open-source BotD detector look at the browser, the keys you type and the way the pointer moves, then explain every signal in plain English.

- Status: live; updated 2026-09-25
- Open: https://lab.hopperlabs.ai/bot-check
- Privacy: nothing is sent anywhere (network: none; storage: none). Check it: https://lab.hopperlabs.ai/labs/bot-check/privacy.json

## What it measures
- **Browser control:** Whether the browser reports WebDriver control or a headless build, or has a debugger reading the page's console.
- **Keys:** Whether typed keys carry physical key codes, Shift for capitals, and the key holds people make (about 50–150 ms).
- **Mouse:** Whether the pointer moved before a click, and whether events came from the operating system or from page script.
- **BotD:** The verdict of FingerprintJS's open-source bot detector, running unmodified on this page.

## How to use it
1. Open the lab. The browser checks start at once and repeat every second for a minute.
2. Type Hello "Lab" 123 into the box and press Check input.
3. Read the verdict and the four tiles. Every flag comes with a line on what it means.
4. Use Copy results to keep the full report as JSON.

## Good to know
- It shows what this page and BotD can see, not what any particular website runs.
- Each run covers one browser on one machine and one network.
- Results stay on your screen. Nothing is collected or sent anywhere.

## Skills for your agent
- [considerate-browser-agent](https://lab.hopperlabs.ai/skills/considerate-browser-agent.md)

## What we found (2026-09-25)
How our own search browser and a few reference setups looked to this lab, one machine, one day.

| Subject | Result | Detail |
|---|---|---|
| Hopper Web Search browser, before the key fix | 3 signals | Keys without key codes, no Shift, 1.4 ms key holds. |
| Hopper Web Search browser, after the fix | No signals | 19 keys with codes and Shift, about 110 ms holds. BotD: not a bot. |
| Plain Chrome, nothing automated | No signals | The baseline every other setup is compared with. |
| Real mouse and keyboard, driven by a script | 1 soft signal | Keys released after 0.5 ms: real input still needs human timing. |
| Text and click made by page script (control) | Flagged | Untrusted events and text without key presses, as it should be. |

Method: Each setup opened the lab on lab.hopperlabs.ai, typed Hello "Lab" 123 and pressed the button; results read from the page's own report.

## How-to


Websites can tell a lot about the browser that opens them: whether a program is driving it, how
keys are typed, how the pointer moves. This lab shows you exactly what one page can see, and
explains each signal in plain English. Nothing is sent anywhere.

## For you
1. Open the **Bot-check lab**.
2. Type `Hello "Lab" 123` into the box and press **Check input**.
3. Read the verdict. Green tiles mean nothing looked unusual; each amber or red flag says what it
   means.
4. Press **Copy results** if you want to keep the report.

## For your AI agent
If your agent browses the web for you, ask it to run this lab on itself before it browses:

> Open https://lab.hopperlabs.ai/bot-check, type Hello "Lab" 123 into the box, press Check input,
> and tell me the verdict and any flags.

For lasting habits, install the **Considerate browser agent** skill: it teaches an agent to pace
like a person, never paste into fields a site is watching, and hand any "are you a robot?" check
to you instead of trying to get around it.

## What the results mean
- **Browser control:** signs that a program is steering the browser (WebDriver, a headless build,
  or a debugger reading the page's console).
- **Keys:** real keyboards send a physical key code, hold Shift for capitals, and keep each key
  down for about 50–150 ms. Scripts often don't.
- **Mouse:** people move the pointer to a button before clicking it.
- **BotD:** a second opinion from FingerprintJS's open-source bot detector.