
The Challenge
Web automation has become a cat-and-mouse game. Modern bot detection systems have learned to identify automated browsers through predictable patterns:- Perfect timing: Bots click exactly 500ms after page load
- Linear movements: Mouse travels in straight lines to targets
- Consistent typing: Every keystroke at identical intervals
- Mechanical scrolling: Always the same speed and distance
- Zero mistakes: No hesitation, no errors, no human variability
- Testing tools getting blocked on production sites
- Web scraping for research hitting endless CAPTCHAs
- QA automation failing due to bot detection
- Monitoring tools getting IP banned
- Data collection becoming unreliable
The Solution
We builtdefinitely-not-a-robot
, a Puppeteer wrapper that embraces human imperfection as a feature. By introducing deliberate randomness and natural movement patterns, it makes automated browsers virtually indistinguishable from human users.
The package leverages puppeteer-extra with StealthPlugin and adds layers of human-like behaviors:
- Bezier curve mouse movements that arc naturally like a human hand
- Variable typing speeds based on ASCII key distances
- Random micro-movements during idle time
- Natural hesitation before important clicks
- Debug visualization to see exactly how the โhumanโ moves
Technical Build
Core Architecture
Language: TypeScript for type safety Bundler: ESBuild for fast compilation Base: Puppeteer-extra with StealthPlugin Output: CommonJS for broad compatibilityKey Implementations
Bezier Mouse Movement Algorithm
ASCII-Based Typing Delays
Jitter Movement System
- 3-95 pixel random movements
- Returns to original position
- Simulates idle hand tremor
- Configurable intensity and count
API Design
Results & Impact
Technical Achievements
- Bezier curve paths instead of straight lines
- 50-150ms random click delays for natural hesitation
- WPM-based typing with variable speeds (default 40 WPM)
- Debug mode showing red path visualization
- Zero dependencies beyond Puppeteer ecosystem
Real-World Usage
The package is used for:- QA Testing: Running tests on production without triggering bot detection
- Web Scraping: Collecting public data for research and analysis
- Automation: Building reliable workflows that donโt break
- Monitoring: Tracking competitor sites without getting banned
Open Source Impact
- Published on npm as
definitely-not-a-robot
- GitHub repository with working examples
- Demo automation of shadcn/ui interface
- Clear documentation and TypeScript types
Lessons Learned
Randomness is Key
The difference between bot and human is unpredictability:- Humans donโt move in straight lines
- Typing speed varies based on key distance
- Everyone has idle hand movements
- Mistakes and corrections are natural
Debug Visualization Matters
The red path tracing was crucial for development:- See exactly how the mouse moves
- Verify Bezier curves look natural
- Spot mechanical patterns instantly
- Tune parameters visually
Simplicity Wins
Rather than complex ML models, simple randomization worked:- Bezier curves for natural arcs
- Normal distribution for delays
- ASCII distance for typing variance
- Basic jitter for idle movement
What Made It Work
- Mathematical foundations โ Bezier curves and easing functions
- Observation of humans โ How people actually move and type
- Debug-first development โ Visual feedback during creation
- Modular design โ Separate utilities for each behavior
- TypeScript โ Caught edge cases during development
Industry Impact
- Proved simple randomization can defeat bot detection
- Showed legitimate use cases need human-like automation
- Demonstrated the importance of imperfection in automation
- Set a template for ethical automation tools
Open Source
definitely-not-a-robot on GitHub
View source code and contribute
Technologies Used
TypeScript
Type-safe development
Puppeteer
Browser automation
ESBuild
Fast bundling
Stealth Plugin
Bot evasion
Bezier Curves
Natural movement
Canvas API
Debug visualization