Every HumanProof token says a person was present. Levels say how hard that
person would be to fake many times over. You choose a level for each site you
register; a token below it is refused with below_site_policy.
| Level | tier | What it shows | What it costs a bot farm |
|---|---|---|---|
| Prove | prove | A person with a passkey: someone completed a passkey ceremony on their own device. | A real device and a person to tap, for every proof. |
| Prove+ | prove_plus | Plus a verified recovery contact. | Every identity costs a real inbox or phone, which makes farms expensive. |
| Attested | attested | Plus certified hardware: the passkey lives on a security key whose attestation was verified. | The hardest proof to fake at scale. |
Choosing a level
- Prove for most forms and actions: sign-ups, contact forms, comments, downloads, text-message codes, costly actions. It stops scripts without asking anything more of real people.
- Prove+ where one person pretending to be many is the threat: votes, likes and reviews, free trials, coupons and credits.
- Attested where bots compete with people for something scarce, such as ticket queues and limited drops, and you can expect people to hold security keys.
The higher the level, the fewer people can meet it. Start at Prove and raise it only for the actions where fakes really cost you. Use cases suggests a level for each.
Setting it
In the hub, HumanProof → Sites: choose the level when you register a site, or change it on the site later. The page shows which levels are available to your organization.