Proof-of-work CAPTCHA explained: no puzzles, no tracking
Updated:
Quick answer
A proof-of-work CAPTCHA makes the visitor’s browser solve a small calculation in the background. For one person it takes a moment and goes unnoticed; for a bot sending thousands of requests the cost adds up. Because it needs no image puzzle and no stored identifier, it adds no friction and can run without cookies. It works best combined with request risk signals.
The idea behind proof-of-work
Proof-of-work was proposed for fighting email spam in the Hashcash paper: make sending a message cost a little computing time. A single sender will not notice it, but a spammer sending millions of messages will.
A CAPTCHA applies the same idea to forms. The server issues a challenge, the browser searches for an answer that meets a difficulty target and sends it back with the form. The server checks it, which is cheap, and only then accepts the request.
Step by step
- The page loads the widget, which asks the server for a challenge.
- The browser computes a solution in the background, typically within a moment on a normal device.
- The solution is submitted together with the form.
- Your server sends the solution to the verification endpoint and gets a success or failure response.
- Only verified requests are processed.
Strengths and limits
| Aspect | Strength | Limit |
|---|---|---|
| Visitor experience | No puzzle to solve, nothing to click. | Very old or weak devices need a little longer. |
| Privacy | No identifier has to be stored; the widget can run without cookies. | The server still sees the request, so processing rules apply. |
| Cost to attackers | Large-scale abuse costs computing time. | A determined attacker with cheap resources can pay it. |
| Adaptivity | Difficulty can rise for suspicious requests. | Needs good risk signals to avoid slowing real users. |
Risk signals make it adaptive
BurgCaptcha combines proof-of-work with request signals such as headless browsers or known bot networks. Suspicious requests receive a harder task, normal visitors a trivial one, so the protection grows with the threat without adding a puzzle.
Frequently asked questions
Does proof-of-work slow down my website?
The calculation runs in the background while the visitor fills in the form and usually finishes before they submit it, so most people notice nothing.
Does proof-of-work drain a phone battery?
The task is small and runs once per form. Difficulty is kept low for normal visitors.
Is proof-of-work enough on its own?
It raises the cost of automated abuse, but sensitive forms should also use rate limiting, server-side validation and monitoring.