What we check
We recompute your score from the keystroke log. When you finish a test, your browser sends the full log of what you typed: every keydown, input and composition event, with its timestamp. Our server recalculates every metric from that log, using the same code that ran in your browser. If the numbers don't match, the result is rejected and logged as metrics_mismatch.
We check a hash. Your browser also sends a SHA-256 hash of the canonical result. The server works it out again, and if the two differ (hash_mismatch), the result was changed on the way, by a script or in transit, and it's rejected.
We check that the test makes sense. A test has to last at least 15 seconds or 10 words. A result can't arrive before the test could have finished. The number of events has to fit the number of characters typed. And every input event has to follow a keydown. The exceptions are typing with an input method editor (IME composition) and typing on a phone, and phone results are scoped to the mobile board.
We look at timing. This includes the average gap between keys and how much it varies, the share of gaps under 40 milliseconds, your longest pause, how consistently you hold keys down, your rollover ratio, how much your speed jumps around second to second, and the share of gaps over one second. A scoring model, with thresholds we keep private, can flag a result as suspicious. Below 130 WPM, a flag doesn't reject anything on its own.
Fast results need a re-test. If a timed result is above 130 WPM and its timing also looks unusual, you'll see it and it's saved, but it stays off the public boards until you pass a verification re-test. That's a fresh 30-second test, and you need to reach at least 75% of the speed you claimed.
We limit how often results can be submitted. Submissions are rate-limited per account and per network address. An account that keeps tripping the checks is shadow-banned, meaning quietly hidden from the boards, and three serious events in 24 hours trigger that automatically.
What keeps a result off the leaderboards
- A hash or metrics mismatch, or a malformed log. These are rejected and not stored.
- A test under 15 seconds or 10 words, a result sent before the test could have finished, or input events with no keydown outside IME composition. These are stored but marked as not validated.
- A pause of more than 5 seconds in a word or quote test. These are stored as paused.
- Over 130 WPM with unusual timing, until you pass the re-test.
- Results typed with custom text, which is never ranked.
- Results from an account that's been hidden or banned.
In every case you still see the full result, and it stays in your history with a note explaining why it isn't ranked.
What we can't catch
We'd rather be upfront about this. A well-built bot that copies human timing patterns can get past timing checks. Our answer is layered: the live re-test, which has to reproduce the speed for real, and community reports, which a person reviews by watching the keystroke replay.
We don't claim the boards are perfect. We do claim that every result on them was recomputed from a log a person can replay.
How to appeal
If a result was rejected or your account was restricted and you think we're wrong, email [email protected] from the address on your account. Include the result link (it starts with /r/) or the date and time of the test. A person watches the keystroke replay and replies within a few days. Appeals are never decided by the automated model alone.
What we don't do
We don't run anything on your computer beyond the web page itself: no drivers, no screen capture, no scanning your browser extensions. We don't share keystroke logs with anyone else (see the privacy page). And we never hide your own numbers from you.
For the longer story behind these checks, read how we detect cheating on a typing test, or see the leaderboards they protect.