Bot Protection that Doesn't Kill UX
Duckity protects your app's APIs from automated abuse using verifiable computational work, rate limiting, and network-level signals, without ever prompting your users.
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Keep scrolling
Say Bye toClicking Buses
Client
Rate-limiting
Network signals
Computational challenges
Your servers
Duckity combines rate limits, network signals, and VDF-backed computational challenges to make abusing your application require meaningfully more resources. All without ever prompting your users.
Stay Privateand Accessible



Protection from Europe
Your end users’ data is stored and processed in Frankfurt, Germany.
Invisibility = Accessibility
Duckity never prompts the user with visual nor auditory puzzles, staying accessible to everyone.
Nothing but IPs
Duckity only processes the client’s IP and their requests. IPs are many times anonymized.
Gain Control
Gain control over your application’s security with Duckity’s applications and policies.
Get Protected for Free
FrequentlyAnsweredQuestions
All of your and your end users' data is processed in Frankfurt, Germany.
We process their IP and any requests made for challenges. Request metadata is kept for as
long as you configure your policies.
Duckity analyzes, scores, and throttles traffic dynamically. With policies, it allows you
to define what human activity looks like. This way, bots are required to behave like
humans. Thanks to our VDF-based proof-of-work challenges that automatically adjust with
activity, you get predictable performance and UX across your clients while substantially
increasing the cost an abuser has to pay to harm your system. Duckity does not try to
figure out who's a bot and who's not, rather enforces rules so that behaving in disallowed
ways costs increasinly extra resources.
Duckity does not try to tell what a human is. Instead, it enforces speed limits and
computational costs that make attacking your system increasingly costly. There's no
one-size-fits-all standard for acceptable behavior, so Duckity allows you to define what
acceptable behavior looks like for your application and enforces it on your behalf, so you
don't have to.
Not at all! We've made it so that you don't take more than a few minutes getting it ready.
It's easy.
CAPTCHAs break UX, they're usually constrained to web platforms, are usually not friendly
for people with accessibility needs, not privacy-friendly¸ rely on AI that tries to
"guess", yield false positives and negatives, and most of the time carry bad experiences
your users have previously had with them elsewhere. Duckity is invisible, user-friendly,
prompts nobody, and is way more cost-efficient than alternatives (up to x2 cheaper than
reCAPTCHA and hCaptcha).
As long as your platform has a CPU, some RAM, and a network connection, yes. Duckity works
in a lot of places, from web apps and native apps to headless CLIs and game engines. We
provide a few SDKs for you to get started with it easily, and in case we don't have one
pre-made for your platform yet, we have a step-by-step guide on how to write one for any
platform. Need help with it? Open a support ticket and we'll help you out!
Got more questions? Email us.
Duckity
© Duckity 2026 - Made with love from Argentina

