What Is a Proof of Work CAPTCHA? The Beginner's Guide

CodexFuse Team · 2026-11-03T16:39:27.696Z · 15 min read min read

What Is a Proof of Work CAPTCHA? The Beginner's Guide

A proof of work CAPTCHA is a CAPTCHA that never asks a visitor to click anything. Instead of image grids, checkboxes, or "select the traffic lights," it hands the visitor's browser a tiny math puzzle to solve quietly in the background — and it has gone from a research curiosity to a mainstream option almost overnight. If you are comparing modern CAPTCHA options, the Turnstile vs reCAPTCHA comparison is the two-product decision guide; this page explains the mechanism behind the fastest-growing third category.

This guide covers what a proof of work CAPTCHA is, where the idea came from (Adam Back's Hashcash, 1997), how the browser puzzle actually works, the two products sold as pure proof-of-work CAPTCHAs — ALTCHA and Friendly Captcha — why they exploded in 2026, the honest limits you should know, and how to add one to your own site.

What is a proof of work CAPTCHA?

A proof of work CAPTCHA is a small computational puzzle that a visitor's browser must solve before the server accepts the request. The puzzle is deliberately easy for the server to verify and deliberately harder for the browser to solve — that asymmetry is the entire point. As the Prosopo team puts it, a proof-of-work CAPTCHA makes the browser solve a tiny hash puzzle before a request is accepted: invisible to a real user, expensive at scale for a bot. A real visitor never notices; a bot firing off thousands of submissions pays a computing cost every single time, until spamming stops being worth the effort.

The idea is old. Adam Back proposed Hashcash in 1997 — announced on the cypherpunks mailing list on March 28, 1997, formalized in his paper "Hashcash — A Denial of Service Counter-Measure" on August 1, 2002 — to fight email spam and denial-of-service attacks. The sender varied a random number (a nonce) and hashed it until the digest had a required number of leading zero bits; the recipient verified with a single hash. Difficulty doubled per bit: 20 bits meant roughly a million hashes. Bitcoin's 2008 whitepaper cited Hashcash and repurposed the same trick (with double SHA-256) for block consensus. A proof of work CAPTCHA is Hashcash, adapted for web forms: the server is the recipient, the browser is the sender, and the "stamp" is computed in a fraction of a second.

One early warning deserves a mention because it still applies. In 2004, Laurie and Clayton's paper "Proof-of-Work Proves Not to Work" argued that professional spammers defeat proof-of-work with botnets of hijacked machines, for whom the CPU time costs nothing. Keep that objection in mind for the limits section below. And if you searched "what is a PoW CAPTCHA" to get here: that is all the acronym means — proof of work, not proof of personhood.

How does proof of work CAPTCHA work?

A proof of work CAPTCHA works in four steps: the server issues a challenge, the browser grinds out a solution, the browser submits it, and the server verifies it almost instantly. Here is the exact arc, based on a real open-source implementation (captchaapi.eu) and the Prosopo engineering write-up, both fetched this week:

1. The server issues a challenge. Your server generates a random seed plus a difficulty target (a 32-bit integer) and hands it to the browser with the form. ALTCHA's version works the same way: every visitor gets the same invisible proof-of-work challenge.
2. The browser solves it in the background. The browser iterates a counter, computing SHA-256(seed || counter) until the result is numerically below the target. The work runs in a Web Worker so the page stays responsive. Solving is meant to take well under a second — measured at roughly 20 ms on a Mac mini M4 and 63 ms on an Apple Silicon iPhone in one production deployment.
3. The browser submits the winning counter (the "nonce"). The solution travels with the form submission. Some implementations bind behavioral signals into the challenge before solving so the work can't be decoupled from the session.
4. The server verifies in constant time. The server re-hashes once. One hash — microseconds — proves the browser did the work. Nothing to store, no session lookup.

The verify-vs-solve asymmetry is the classic Hashcash property, now running in a Web Worker instead of an email client. And one clarification worth making once: a proof of work CAPTCHA is not crypto mining. The puzzle is a single, tiny, one-time computation per form — it is closer to a wax seal than a mining rig.

What is ALTCHA? Meet the two pure proof-of-work CAPTCHAs

ALTCHA and Friendly Captcha are the two mainstream products marketed as pure proof-of-work CAPTCHAs — and ALTCHA is a product, a self-hosted open-source widget, not a generic term. (The standalone "what is altcha" question is owned by altcha.org itself, so it gets a section here, not its own page.)

ALTCHA calls itself a CAPTCHA alternative that verifies visitors with a silent proof-of-work challenge "instead of puzzles or image quizzes — no tracking, no cookies, and nothing for real users to solve." A silent cryptographic challenge runs in the background; real users just submit. The open-source widget is free forever, with no sign-up, API keys, or usage limits, MIT licensed. Paid tiers start at €47/month for ALTCHA Cloud (EU-only endpoints, 30-day trial), €99/month for self-hosted ALTCHA Sentinel, and €18.90/month for the WordPress plugin. ALTCHA's own page claims 300,000+ live websites (BuiltWith figure, self-reported), WCAG 2.2 AA conformance, 50+ languages, and full GDPR compliance. It is the reference altcha captcha implementation — the one the Joomla team chose for its core plugin. With the paid tiers, risk signals can escalate to an interactive accessible code check — so proof of work is the baseline layer, not always the whole product.

Friendly Captcha, a German company, describes itself as "the first truly invisible CAPTCHA based on proof-of-work." Its version: Friendly Captcha generates a unique crypto puzzle for each visitor's device, and as soon as the user starts filling in a protected form, it is solved automatically — "solving it will usually take a few seconds." Unlike ALTCHA's pure-PoW open-source widget, Friendly Captcha explicitly pairs proof of work with "advanced risk signals" (browser identification, network risk, behavior analytics). Pricing: Starter €9/month (1 domain, 1,000 requests), Growth €39/month, Advanced €200/month (includes "smart difficulty scaling"), Enterprise custom; a free tier covers non-commercial sites (1 domain, 1,000 requests/month). The company reports 2.6 billion web interactions verified per year, 99.99% historical uptime, and zero cookies or trackers — and lists ISO 27001, GDPR, WCAG 2.2 AA, PCI DSS, and DORA compliance. One honest detail from Friendly Captcha's own docs: on older phones, a puzzle sized to be invisible on a laptop can take up to 20 seconds.

Proof of work CAPTCHA vs traditional CAPTCHA

If you are comparing PoW CAPTCHA vs traditional CAPTCHA, the difference is fundamental: it never tests the visitor — it taxes them. An image grid asks "are you human?" A proof-of-work puzzle asks "are you willing to spend 50 milliseconds of CPU?"

The last row is the real story. reCAPTCHA's image grids were already losing: vision models started solving them with higher accuracy than humans, and commercial solving farms were clearing reCAPTCHA v3 tokens at roughly $1 to $2 per 1,000 (Prosopo's figure). If you arrived from the "friendly captcha vs recaptcha" question, the short version is this: where reCAPTCHA scores your behavior or shows image grids, Friendly Captcha's pure-PoW tier simply charges the browser a few seconds of compute — no cookies, no behavior model. Proof of work sidesteps that game entirely — but it starts a new one, which is the subject of the limits section below.

Why proof of work CAPTCHAs exploded in 2026

Two forces made proof-of-work CAPTCHAs mainstream: Google cut reCAPTCHA's free tier by 99% in April 2024, and Joomla shipped a native proof-of-work CAPTCHA in core.

The first force is money. Prosopo's explainer dates the turning point precisely: when Google cut reCAPTCHA's free tier from 1,000,000 to 10,000 assessments per month in April 2024, thousands of small teams started looking for alternatives. The two products that benefited most — Friendly Captcha and ALTCHA — are both marketed as pure proof-of-work CAPTCHAs: no image grids, no traffic lights, no third-party cookies, no per-verification bill.

The second force is legitimacy. Joomla 6.1 and later (including 6.2) ship a built-in core plugin called "CAPTCHA – Proof of Work," based on the ALTCHA library. It needs no API keys, relies on no external service, and has no privacy implications. Joomla's own feature page is strikingly honest about the philosophy: "It's not supposed to proof humanship of the user, but to proof that the user is willing to invest the necessary time to solve the task" — and "a fight that we can't win anyways," referring to proving humanness outright. The plugin is enabled on a fresh install, though the Default Captcha setting is still "None," so the admin must select it under System → Global Configuration → Site → Default Captcha. Difficulty is adjustable: Easy, Moderate (the default), Hard, or Custom with a Maximum Number. An independent tester measured real solve times on headless Chrome: 0.04–0.09 s on Easy, 0.14–0.25 s on Moderate, and about 0.43 s on Hard. The old Google-dependent reCAPTCHA plugins were removed during the Joomla 5 series — outdated, and dependent on Google.

When proof of work is enough — and when it isn't

A proof of work CAPTCHA is enough for everyday bot deterrence, and not enough for anything with money attached. The Prosopo team's honest summary: fine for a hobby comment form; not fine for anything with money attached. The indie captchaapi.eu author draws the same line: for most EU SaaS use cases — login forms, signup forms, contact forms, comments, newsletter signups — the limitations don't matter. For exchanges, betting platforms, gaming auth, and other high-value targets, layer proof of work with additional defenses or use a different category of tool entirely.

The limits, all sourced from vendor and independent write-ups fetched this week:

1. GPUs and botnets buy the asymmetry back. A modern GPU or dedicated hashing chip solves the same SHA-256 puzzle orders of magnitude faster than a browser's JavaScript runtime. Any attacker willing to spend a few hundred dollars on GPU capacity is buying the asymmetry back in their favor (Prosopo). The 2004 botnet objection to Hashcash applies here too — hijacked machines pay nothing for CPU time.

2. Solver farms sell the puzzle, too. Services like Anti-Captcha accept a Friendly Captcha challenge as input and return a valid solution at commodity solver-farm prices (Prosopo). And human click-farms work "just as well against PoW": the human clicks "Verify" and waits 100 ms — the underlying mechanism doesn't matter to them — at networks paying humans about 50¢ per 1,000 solves (captchaapi.eu author).

3. Proof of work produces zero signal. A solved puzzle tells you nothing about whether the request came from a residential proxy, a stealth headless browser, or a legitimate Chrome user — it is a one-bit verdict with no risk score to feed forward. Sophisticated bots driving real browsers via Selenium, Playwright, or Puppeteer pass it the same way a human does.

4. Real users pay a device cost. A puzzle sized to be invisible on a modern laptop takes noticeably longer on a five-year-old Android phone — Friendly Captcha's own docs acknowledge this can reach 20 seconds. Tens of milliseconds of hashing per form is a measurable battery hit at web scale.

So the pattern in practice is layering. Prosopo pairs proof of work with behavioral, device, and network signals. Cloudflare Turnstile folds proof of work into a wider challenge set — and here is a fact worth stating once, because even the Prosopo explainer gets it wrong: Prosopo claims "Cloudflare Turnstile and Google reCAPTCHA v3 do not use proof of work," but Cloudflare's own docs say Turnstile's challenges "include proof-of-work (computational puzzles), proof-of-space, probing for web APIs, and various other challenges." Similarly, the ALTCHA vendor page is wrong about its own license in reverse: Prosopo says ALTCHA is Apache-licensed, but altcha.org says MIT — the vendor's own page is authoritative. At the server layer, the Anubis beginner guide covers the self-hosted proof-of-work reverse proxy, a different lane from the form-widget products on this page.

How to add a proof of work CAPTCHA to your site

The fastest way to get a proof of work CAPTCHA is the ALTCHA open-source widget (self-hosted, MIT, free forever, no sign-up or API keys) or your CMS's native option. Three beginner paths, depending on your stack:

Joomla 6.1+. If you run Joomla 6.1 or later, you already have it: go to System → Global Configuration → Site → Default Captcha, choose "CAPTCHA – Proof of Work," and save. It then protects registration, password reset, contact, and front-end article forms. Adjust difficulty under System → Plugins → CAPTCHA – Proof of Work (Moderate is the default; a tested setup found it adds about 0.14–0.25 s of invisible solving per form).

Any site (self-hosted). ALTCHA's free open-source widget is the do-it-yourself route: serve its challenge from your own server, drop the widget on your forms, verify solutions server-side. No account, no keys, no third-party calls — this is the setup the captchaapi.eu author built as a one-person project, which runs 5,000 challenges a month on its free tier with no cookies and per-IP pseudonymized rate limiting.

Managed (no server work). Friendly Captcha's managed route covers the same idea without self-hosting, with a free non-commercial tier (1 domain, 1,000 requests/month). For the reverse-proxy lane instead of form widgets — proof of work checked before traffic ever reaches your app — see the self-hosted PoW reverse proxy walkthrough. And for the Turnstile angle, where proof of work is one challenge among several, the Turnstile vs reCAPTCHA pricing guide covers the decision.

Sources

• ALTCHA homepage — altcha.org (product description, MIT license, pricing tiers, "300,000+ live websites" claim; fetched 2026-11-03)
• Friendly Captcha homepage — friendlycaptcha.com (how it works, pricing, 2.6B interactions/year, certifications; fetched 2026-11-03)
• Prosopo — "PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own" — prosopo.io/blog/pow-captcha/ (mechanism, five failure modes, reCAPTCHA free-tier cut, solver-farm pricing; fetched 2026-11-03)
• captchaapi.eu engineering write-up on dev.to — "CAPTCHA without cookies: a proof-of-work approach" (protocol, 20 ms / 63 ms measurements, honest trade-offs, 50¢/1,000 human-farm figure; fetched 2026-11-03)
• Hashcash history — Adam Back's paper "Hashcash – A Denial of Service Counter-Measure" (2002) and wiki explainers (vectree.io, grokipedia.com) for the March 28, 1997 announcement and the SHA-1 partial-preimage mechanism; Laurie & Clayton 2004 ("Proof-of-Work Proves Not to Work") via vectree.io; fetched 2026-11-03
• Joomla "CAPTCHA – Proof of Work" feature page — developer.joomla.org (built-in plugin, no API keys, "not supposed to proof humanship"; fetched 2026-11-03)
• Infyways — "Joomla 5 CAPTCHA & Joomla 6.2 Built-in CAPTCHA: Tested Setup" (Oct 15, 2026 — difficulty options, tested solve times 0.04–0.43 s, enable path; fetched 2026-11-03)
• Cloudflare Turnstile docs — developers.cloudflare.com/turnstile/ (proof-of-work listed among challenge types, no CDN routing required, WCAG 2.2 AA; fetched 2026-11-03)

Frequently asked questions

What is ALTCHA?

ALTCHA is a product: a privacy-first, self-hosted CAPTCHA alternative built on proof of work. Its open-source widget is free forever, MIT licensed, needs no sign-up or API keys, and runs a silent cryptographic challenge in the background instead of puzzles. Paid tiers (Cloud, Sentinel, WordPress plugin) add managed hosting and risk-signal escalation.

Does a proof of work CAPTCHA need cookies or track users?

No — that is one of its main advantages. ALTCHA's widget uses no tracking and no cookies, and the captchaapi.eu implementation was deliberately built without them: per-IP rate limiting is done with a salted SHA-256 of the visitor's IP that is never persisted. There is no cross-site risk model because there is no cross-site data collection.

Does a proof of work CAPTCHA slow down visitors' phones?

Barely on modern hardware: about 20 ms on a desktop-class machine and 63 ms on an Apple Silicon iPhone in measured production runs. But Friendly Captcha's own docs acknowledge puzzles can take up to 20 seconds on older phones, and hashing costs battery. Well-configured difficulty keeps this invisible for most visitors.

Can bots bypass a proof of work CAPTCHA?

Yes — dedicated attackers can. GPUs solve SHA-256 puzzles orders of magnitude faster than browser JavaScript, botnets pay nothing for CPU, commercial APIs like Anti-Captcha accept Friendly Captcha challenges as input, and human click-farms work at about 50¢ per 1,000 solves. Proof of work proves compute happened, not that a human is there. Layer it with behavioral signals or a reverse-proxy check like the Anubis beginner guide describes for anything high-value.

Is Cloudflare Turnstile a proof of work CAPTCHA?

Partially. Cloudflare's own Turnstile docs list "proof-of-work (computational puzzles)" among its non-interactive challenges, alongside proof-of-space and browser-API probing — and Turnstile doesn't require routing traffic through Cloudflare's CDN. But Turnstile is a broader risk-challenge platform, not a pure-PoW product like ALTCHA or Friendly Captcha. For the full comparison, see the Turnstile vs reCAPTCHA decision guide.