Just Human Chrome extension security report

Just Human - Show that you wrote it. Words on the internet are changing. More and more of them appear instantly - polished, effortless, with no corrections or pauses. They're perfect. And that perfection is exactly the problem. Just Human is a Chrome extension that sits quietly in your browser's side panel while you write on X.com. As you type, it watches your writing rhythm - the natural pauses when you think, the backspaces when you fix a typo, the speed changes between easy and difficult words. When you hit Post, it automatically appends a proof link to your tweet. Anyone who clicks that link can watch your entire writing process unfold keystroke by keystroke, and see an analysis score showing how human your writing looks. No setup. No account. No signup. Just write and post. HOW IT WORKS 1. Open the side panel by clicking the Just Human icon in your browser toolbar. 2. Start typing in any X.com compose box - a tweet, a reply, a quote tweet. The extension detects the compose box automatically. 3. Write naturally. The side panel shows your live stats: characters, words, and typing speed. 4. When you click Post, the extension saves your typing data, generates a proof link, and appends it to your tweet before it goes out. 5. That's it. Your followers see your words plus a small link. Anyone curious can click it and watch you type the whole thing. You can also use the "Save & share" button in the side panel if you want to generate a proof link without posting - useful for drafting or for content you plan to paste somewhere else. WHAT PEOPLE SEE WHEN THEY CLICK YOUR LINK Your proof page on justhuman.app shows: - A real-time replay of your writing. Every character appears at the speed you typed it, with all the pauses, corrections, and rewrites intact. Viewers can control playback speed (1x, 2x, 5x, 10x), pause, scrub through the timeline, or let it auto-replay. - A human-likeness score from 0 to 100. This score is computed server-side from nine independent signals in your keystroke data. It's not something you or your browser can manipulate - the analysis runs on our servers from the raw event data. - A detailed breakdown of all nine metrics, so viewers can see exactly which signals contributed to the score. The replay is the real proof. The score is a summary for people who don't want to watch the whole thing. THE NINE SIGNALS Just Human analyzes nine different patterns in your keystrokes. Here's what each one measures and why it matters: Rhythm Variability - Humans don't type at a constant speed. You slow down when you're thinking about word choice, speed up when you're on a roll, and have natural micro-variations between every keystroke. A perfectly uniform rhythm is a red flag. This metric measures how much your inter-keystroke timing varies and whether that variation looks natural. Error Corrections - Real writers make typos and fix them. The rapid backspace-retype sequence that happens when you catch a mistake mid-word is instinctive and hard to simulate. This metric looks at how often corrections happen and whether they follow that characteristic human pattern. Paste Content - How much of your final text was pasted in versus typed character by character. Pasting a URL or a name is normal. But if 90% of the text was pasted from somewhere else with minimal actual typing, that's a strong signal the content wasn't written in real time. Think Pauses - People stop to think. Between sentences. Before a difficult word. After re-reading what they just wrote. This metric checks for natural thinking breaks and whether they fall near sentence and clause boundaries, the way they do when someone is actually composing thoughts. Timing Distribution - Human keystroke timing follows a statistical pattern: most gaps between keys are short, with a long tail of slower ones (technically a log-normal distribution). This signal checks whether the overall shape of your timing data matches what we'd expect from a real person. Digraph Timing - When you type the same pair of letters repeatedly (like "th" or "er"), your fingers take roughly the same time each time because of muscle memory. This metric checks whether repeated character pairs have consistent timing, and whether physically distant keys take longer than adjacent ones - a biomechanical pattern that automation tools don't reproduce. Dwell Time - How long you hold each key down before releasing it. Humans typically hold keys for 50–200 milliseconds with natural variation across fingers - pinkies tend to be slower than index fingers. Browser automation tools like Playwright produce near-zero dwell times (0–2ms), making this one of the strongest signals. Burst-Pause Patterns - People type in bursts that roughly correspond to words, with short pauses between them and longer pauses between sentences. This metric checks whether your writing shows natural word-level clustering rather than randomly distributed pauses. Fatigue - Over the course of a writing session, humans gradually slow down and make slightly more errors. This metric divides your session into quarters and checks for the subtle speed decrease and error-rate increase that characterize real fatigue. A machine doesn't get tired. These nine signals combine into a single score. Above 80 earns a "Written by a human" badge. Between 50 and 80, the result is uncertain. Below 50, the analysis suggests the input may be automated. If a piece of writing is too short to analyze meaningfully - fewer than 30 keystroke events or under 5 seconds - it receives a neutral badge instead of being scored. WHY THIS MATTERS Being human has never been about getting it right on the first try. It's about the backspace. The sentence you rewrote three times because it didn't quite capture what you meant. The long pause where you stared at the screen, thinking. The typo you caught - or didn't. These aren't flaws in your writing. They're proof that someone was actually there, wrestling with an idea, trying to make it honest. A machine can produce text, but it cannot hesitate. It cannot change its mind. It cannot care whether the words are true. We built Just Human because we believe the process matters as much as the result. When you share a replay of your writing, you're not just sharing words - you're sharing evidence of thought. Every correction is a small act of integrity, every pause a moment of genuine reflection. In a world that's increasingly flooded with effortless content, the courage to show your rough edges might be the most human thing you can do. If you're a writer, a journalist, a researcher, a student, or just someone who cares about being believed when they say "I wrote this" - this tool is for you. OPTIONAL WALLET SIGNING If you have a Cardano Lace wallet browser extension installed, Just Human lets you cryptographically sign your posts with your Cardano blockchain address. This is entirely optional - the extension detects whether Lace is present and only shows the wallet option if it is. When connected, each recording you save is signed using the CIP-30 signData standard. The signed message contains your post text and is bound to your Cardano address. The signature is submitted to justhuman.app and displayed on your proof page, linking your on-chain identity to your writing. This adds a second layer of proof: not only can viewers watch you type every word, they can also verify that a specific wallet holder vouched for the content. No tokens are transferred, no transactions are made, and no funds are involved - the wallet is used solely for its cryptographic signing capability. You can connect or disconnect your wallet at any time from the side panel. Connection state is stored locally in your browser. If Lace is not installed, the wallet feature is completely hidden. PRIVACY - Your keystrokes stay private until you choose to share. Nothing is sent anywhere until you post or click "Save & share." - We never store your raw IP address. Rate limiting uses a SHA-256 hash with a daily rotating salt. - Recordings are public once shared - that's the point. Don't type anything you wouldn't share openly. - We collect minimal browser environment signals (plugin count, language count, webdriver flag) to calibrate analysis confidence. We don't track you, profile you, or sell anything. - No account required. No personal information collected. No cookies beyond what's technically necessary. - Wallet signing is opt-in. If you connect a Lace wallet, your Cardano address and signature are sent to justhuman.app and displayed publicly on your proof page. No private keys ever leave your wallet. Full privacy policy: https://justhuman.app/privacy Terms of service: https://justhuman.app/terms ANTI-BOT DEFENSES Just Human exists to show that a person wrote something, so we take automated submissions seriously: - Event integrity verification: the server replays every keystroke event from scratch and verifies the result matches your final text. If the events don't reproduce the text, the submission is rejected. - Rate limiting: 20 submissions per hour, 240 per day per IP. - Browser environment checks: we detect automation flags (webdriver, Playwright globals) and use them to calibrate confidence - not to block submissions. - Typing biometrics: beyond timing between keys, we record dwell time (how long each key is held) and flight time (gap between releasing one key and pressing the next), plus the physical key code. These enable per-finger analysis that's extremely difficult to fake. - Server-side scoring: analysis runs on our servers at submission time, not in your browser. The score can't be manipulated client-side. We never reject a recording based on its score. Low-scoring recordings are saved and remain viewable - the score is shown honestly. Our goal is transparency, not gatekeeping. No algorithm can definitively prove authorship. Dictation software, accessibility tools, and mobile keyboards may produce unusual patterns. These signals are indicators, not guarantees - the replay itself is always the strongest evidence. TECHNICAL DETAILS - Works on x.com and twitter.com - Uses Manifest V3 with the Side Panel API - Requires permissions: sidePanel, activeTab, storage, clipboardRead, clipboardWrite, scripting - All data is sent to justhuman.app over HTTPS - No external analytics or tracking scripts in the extension - Open side panel via the toolbar icon; it stays open as you navigate X.com - Detects compose boxes automatically, including reply modals and quote tweets - Dark mode supported, follows your preference - Optional Cardano wallet integration via the Lace browser extension (CIP-30 signData) for cryptographic signing - no transactions, no funds involved - Wallet bridge runs in the page's MAIN world to access the Lace API; all other extension code runs in isolated contexts BUILT BY Dynamic Strategies - a development and research firm building tools at the intersection of technology and the open web. Website: https://justhuman.app About: https://justhuman.app/about Contact: https://x.com/dynamic_io