humanmark.dev

What It Is

Humanmark is a human-presence verification API for enterprises and developers. Its goal is not to identify “who you are,” but to determine whether a request was actively authorized by a real human. It positions itself as a new signal beyond CAPTCHA, behavioral analytics, and risk scoring, using Apple/Google device attestation, hardware-backed security capabilities, biometric or device-passcode confirmation, and non-replayable cryptographic signatures to verify human intent.

Core Capabilities and Security Dimensions

In terms of protection, it mainly covers anti-automation, anti-AI impersonation, anti-emulator, and anti-replay scenarios, making it suitable for checkpoints such as account creation, content posting, high-value transactions, and rate limiting. Deployment requires integration with the official SDK and backend API, while end users also need to install the free Humanmark App, which introduces more friction than invisible CAPTCHA solutions. Its privacy design is a highlight: no account, no registration, and no personal data collection, with the claim that data is discarded immediately after verification. Management and alerting details are limited, with only 24/7 system monitoring, technical integration support, and user resources mentioned.

Pricing and Compliance

Pricing is fairly clear: the free tier includes 2,000 successful verifications per month; Starter is $49/month, Growth is $299/month, and Scale is $999/month, with overage billed based on successful verifications. Failed, canceled, and erroneous attempts do not count against the quota, and there are no setup or termination fees. However, it is currently in Beta, so pricing and features may change, and no specific uptime is guaranteed. On compliance, the company has not disclosed certifications such as SOC 2 or ISO 27001, only stating that its no-data-retention approach can reduce GDPR and CCPA-related burden.

Pros, Cons, and Who It’s For

The main advantage is its clear approach: relying on hardware-level attestation rather than continuing the arms race where AI learns to defeat image puzzles or behavioral models. It is also privacy-friendly, making it a fit for ecommerce sites, content platforms, social networks, and marketplaces that need to distinguish humans from automation. The drawbacks are also obvious: it depends on modern smartphones and platform security hardware, so alternative flows are needed for incompatible users; app installation may hurt conversion; and the official terms acknowledge that false judgments, device vulnerabilities, or future attacks may still occur. As a result, it is better suited as one signal within a broader security stack rather than as the only line of defense.

Access from China and Alternatives

The main text states that there are no geographic restrictions and that it works with smartphones globally, but it does not provide information on mainland China network connectivity, ICP filing, domestic nodes, or local payment options, so China accessibility remains unknown. For products targeting users in China, App download availability, API latency, network reachability, and invoicing/payment workflows should be tested in practice. Alternatives can be considered by scenario, including traditional CAPTCHA, WebAuthn, risk scoring, and domestic options such as GeeTest, Tencent Cloud Captcha, and Alibaba Cloud Captcha.