LiveSafe browsing for agentsRuns in your browser

Human typing lab

Why can a website tell a person's typing from a script's?

Type one sentence and see what a page can observe about your typing, side by side with a simple script typing it: where the keys came from, their timing and modifiers, explained in plain English. Nothing is stored or sent.

Updated

The human typing lab, with the sentence to type and a list of what a page can observe about typing

What it measures

Where keys came from

Whether each key event came from the operating system or was made by page script, a mark the browser sets and page script cannot change.

Timing

How long each key stays down and how much the time between keys varies.

Keys and modifiers

Whether keys say which physical key was pressed, and whether capital letters came with Shift or Caps Lock.

Pasting

Text that arrives in the box without any key presses.

How to use it

  1. Open the lab and type the sentence shown, at your normal speed.
  2. Press Compare with a script. A simple script types the sentence into its own box.
  3. Read the two columns side by side, and the bars showing how long each key was held.
  4. Read what a page can observe, and why sites look.
Open the lab

Good to know

  • It compares you with one simple script. Real sites combine many more signals; the bot-check lab shows more of them.
  • On-screen keyboards, other layouts, Caps Lock, dictation and accessibility tools all look different, and all are fine. The lab says when it cannot measure something.
  • It explains what pages can observe. It is not a guide to getting past a site's checks, and our agent skill says not to try.

Give your agent this skill

Try the lab, then let your AI agent keep what it teaches. Read the skill first; install it only if you want to.

What we found

We fed the lab typing from two kinds of automation and its own built-in script. Each was either detected or left nothing to measure. Key events sent through Chrome's DevTools protocol are marked as coming from the operating system, so that mark alone did not reveal them.

Measured
DevTools key events, no delay (how many automation tools type)
Noticeable
All 61 events marked as from the operating system, but keys were held for about 1–2 ms and 2 of 2 capital letters came with neither Shift nor Caps Lock.
DevTools text insertion
Nothing to measure
The sentence appeared in the box with no key presses at all, which a page can notice in itself.
The lab's own script (page-script events, 20 ms gaps)
Made by page script
0 of 61 events from the operating system, no key codes, and a rhythm that varied by only 2%.

Method: Chrome 154, headless, scratch profile, the lab served locally exactly as the site mounts it. The lab's sentence typed over the DevTools protocol, then Compare with a script pressed; results read from the page.

How-to

Sites that fight spam and fraud look at how text arrives, not just what it says. This lab shows what a page can observe while you type, next to what a simple script produces, so you can see why sites notice automation.

Try it

  1. Open the human typing lab and type the sentence at your normal speed.
  2. Press Compare with a script and read the two columns side by side.
  3. Look at the bars: each is one key, and its height is how long the key was held.

What the lab measures

  • Where each key event came from. The browser marks events from the operating system differently from events made by page script.
  • Timing. How long each key stays down, and how much the gaps between keys vary.
  • Keys and modifiers. Whether keys say which physical key was pressed, and whether capital letters came with Shift or Caps Lock.
  • Pasting. Text that arrives without key presses.

No single signal proves anything. On-screen keyboards (especially on Android), other layouts, Caps Lock, dictation and accessibility tools all look different, and all are fine. The lab says when it cannot measure something rather than guessing.

If you build or use an AI agent

Do not try to make an agent look human or get around a site's checks. Let it go at a person's pace, and hand any check it meets, such as a CAPTCHA, back to its person. The Considerate browser agent skill teaches that, and the bot-check lab shows the other signals sites see.

Check that it's private

This lab runs entirely in your browser and sends nothing anywhere. You don't have to take our word for it:

  1. The browser enforces it. This site's security policy only lets pages talk to lab.hopperlabs.ai. This command shows connect-src 'self':curl -sI https://lab.hopperlabs.ai/labs/human-typing/run | grep -i content-security-policy
  2. Every file is listed with its fingerprint and source commit in privacy.json, so you or your agent can compare them and read the code.
  3. Once the lab has loaded, turn off Wi-Fi: it keeps working, because it needs nothing from the network.

This page sends nothing anywhere. If an AI agent or browser extension is reading your screen, it can see what's shown here.

More labs

All labs