RHF-LockMatch: a lock-style human-verification challenge built around the original RHF·ART hand-drawn collection. No distorted text, no traffic lights. Three challenges no checkbox can copy.
Tap the drawing that matches the reference
3 misses refresh the challenge
Reference
Take your time. Bots can't.
How this becomes a service
01 · EMBED
One snippet
Companies paste a single <script> tag. The lock widget renders inside their form, login or checkout, styled to match their brand.
02 · VERIFY
Server-side check
Every solve is validated on our API. A signed token is returned; the company's backend accepts it like any auth token.
03 · DASHBOARD
Insight + billing
Customers see solve rates, block stats and bot pressure per site. Billed per verification, per month, or per seat.
Why your drawings are a real advantage
Unseen by bots. Vision models are trained on public datasets. Your 12 hand-drawn originals exist nowhere in their training data. Recognition attacks start from zero.
Hands, not just eyes. Drag-and-drop and rotation challenges require real pointer movement and spatial judgment. Far harder to script than a click.
Visual-only matching. The challenge shows no titles or labels, so there's no text shortcut for a script to read.
Freshness is cheap. New drawings can be added anytime; rotating the art pool keeps automated solvers permanently behind.
Human-friendly. Matching colorful art beats squinting at warped letters. Higher completion rates, fewer abandoned forms.
About this sample: v5 uses the actual 12 RHF·ART scans from awesomerentals.online,
embedded in this single file. The three signature challenge modes:
Drag it (drag the matching drawing into the slot, mouse and touch),
Rotate it (spin the drawing upright, then verify alignment),
Memory pairs (flip the cards, find all three matching pairs).
These three are the RHF-LockMatch signature set: movement, spatial judgment, and memory. No other verification
service challenges humans this way.
A production service also needs server-side verification, rate limiting and signed tokens; the browser alone can't be trusted.