PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own

Proof-of-work CAPTCHAs went from a research curiosity to a mainstream option almost overnight when Google cut reCAPTCHA's free tier by 99% in April 2024 and pushed thousands of small teams to look for alternatives. The two products that benefited most — Friendly Captcha and ALTCHA — are both marketed as pure proof-of-work CAPTCHAs: no image grids, no traffic lights, no third-party cookies, no per-verification bill.

This post explains what a PoW CAPTCHA actually is, why the mechanism is compelling as a silent first line of defence, and — the part most vendor pages leave out — where it stops being enough on its own.

What is a PoW CAPTCHA?

A proof-of-work CAPTCHA is a small computational puzzle that a visitor's browser must solve before the server accepts the request. The puzzle is deliberately easy to verify and deliberately harder to solve — the classic asymmetry that Adam Back proposed in Hashcash in 1997 for anti-spam use and that Bitcoin later borrowed for block consensus.

In a modern CAPTCHA implementation the flow is short:

1. The visitor's browser requests access to a protected resource — a form, a queue, an API endpoint.
2. The server issues a puzzle: usually finding an input whose hash starts with a certain number of zero bits, sized so that the expected solve time on a typical device is well under a second.
3. The browser computes the solution in a WebWorker so the page stays responsive.
4. The browser returns the solution alongside the original request; the server verifies it in constant time and processes the request.

The verification is trivial. Solving requires actual CPU work proportional to the puzzle's difficulty. A real user sees nothing. An automated client that wants to fire a thousand requests now has to do a thousand puzzles' worth of compute.

For the full mechanism, see the proof-of-work glossary entry. This post is focused on the product-level decision: when is PoW the right answer, and when is it not.

Why PoW went mainstream

Three things happened at once:

1. Google cut reCAPTCHA's free tier from 1,000,000 assessments/month to 10,000 in April 2024, and teams that had been running reCAPTCHA on hobby-scale forms suddenly had a per-verification bill.
2. GDPR scrutiny of Google-owned advertising cookies made the compliance overhead of shipping reCAPTCHA to EU visitors — consent banner, DPA entry, Schrems II transfer basis — visible to teams that had previously ignored it.
3. Vision models started solving reCAPTCHA v2 image grids with higher accuracy than humans, and commercial CAPTCHA-solving farms began clearing v3 tokens at roughly $1 to $2 per 1,000. Paying Google for verdicts that farms cleared for a fraction of a cent stopped making sense.

Pure-PoW products — Friendly Captcha and ALTCHA — moved into that vacuum. The pitch is genuinely appealing: no cookies, no user interaction, no third-party US processor, no per-request bill. For a personal blog with a comment section that gets ten submissions a day, that is a complete answer.

Where PoW is genuinely compelling

There are four properties that make proof-of-work well-suited as a silent first line of defence:

• Invisible to real users. No widget to render, no image grid to click, no consent banner to reason about. The puzzle computes in the background.
• Hard to outsource. Unlike image challenges, there is no "puzzle farm" — every request needs its own solution computed at request time. You can't hand off a thousand PoW challenges to a $2-per-thousand human labelling service the way you can with reCAPTCHA v2.
• No PII by construction. The puzzle is computed and returned inside the browser; the server verifies a hash. No cookies, no cross-site identifiers, no personal data collected by the challenge itself. The GDPR posture of the challenge step is the easiest of any CAPTCHA class to defend.
• No per-verification cost. Compute is cheap and the puzzle scales with attacker cost, not defender cost. The vendor doesn't need to bill you per assessment the way reCAPTCHA Enterprise does above 10,000/month.

Those properties are the entire pitch on Friendly Captcha's homepage, and the entire reason ALTCHA can ship as an Apache-licensed open-source library. They are all true.

Why PoW alone isn't enough

The problem is that all four properties describe the challenge step, not the defence. PoW puts a compute toll on the door. It doesn't check who paid the toll, or where they came from, or whether they've paid it a thousand times in the last minute. Five specific failure modes come up over and over in production:

1. GPUs and ASICs break the compute-cost asymmetry

The whole PoW pitch depends on the attacker's cost per request being meaningfully higher than the defender's. A modern GPU or a dedicated hashing chip solves the same SHA-256 puzzle orders of magnitude faster than the JavaScript runtime in a real user's browser. Raise the puzzle difficulty enough to matter against dedicated hardware and the mobile-battery cost for legitimate users becomes noticeable. Keep it low enough to be invisible and a modestly resourced attacker walks straight through.

Cryptocurrency mining farms have spent a decade optimising exactly this compute pipeline. Any attacker willing to spend a few hundred dollars on GPU capacity is buying the same asymmetry back in their favour.

2. Commercial solver APIs are a $1-per-thousand service

Solving PoW at scale is a well-understood problem. Services like Anti-Captcha publish APIs that will accept a Friendly Captcha challenge as input and return a valid solution at commodity solver-farm prices, distributed across the same residential-proxy infrastructure attackers already use for account creation, credential stuffing and scraping. Once a CAPTCHA becomes popular enough to be worth solving, someone builds an API for it. Friendly Captcha and ALTCHA both crossed that threshold in 2024.

3. PoW doesn't tell you who the requester is

The puzzle solution proves that compute happened. It doesn't tell you whether the request came from a residential proxy, a stealth-headless browser, a datacentre IP that has attempted 40,000 signups this week, or a legitimate Chrome-on-Windows user with a consistent JA4 fingerprint. Every request looks identical to the server — a valid solution, and nothing else to score.

This is the property that pure-PoW products cannot fix without becoming layered products. Bot detection needs context: who is this, what have they done recently, does this behaviour pattern match the last hundred humans or the last hundred bots.

4. Battery cost on real user devices

A puzzle sized to be invisible on a modern laptop takes noticeably longer on a five-year-old Android phone on a 4G connection. Push the difficulty up to matter against attackers with real hardware and the legitimate-user experience starts to degrade — visible warmth on the device, a brief loading spinner, occasionally a failed solve on very low-end hardware. Friendly Captcha's own docs acknowledge this can reach 20 seconds on older phones.

5. No signal for the layers above

A modern bot-protection stack uses the CAPTCHA verdict as one input to a broader decision — combined with IP reputation, device fingerprint, session history, rule matches. A pure-PoW verdict is one bit: solved or not solved. There is no risk score to feed forward, no signal set to correlate with account behaviour, no per-request telemetry to stream into a SIEM. The rest of the stack has to work harder because the CAPTCHA layer contributed almost nothing.

What pure-PoW products get wrong

The specific failure — the one that shows up in every customer conversation about switching away from Friendly Captcha or ALTCHA — is that the marketing frames PoW as bot protection when it's actually one layer of a bot protection product. From the full Prosopo vs Friendly Captcha comparison:

The primary "bot protection" consists of a short code snippet that only checks user-agent strings. Sophisticated bots can easily simulate browser environments using tools like Selenium, Playwright, and Puppeteer. Commercial solving services like Anti-Captcha offer API support for bypassing Friendly Captcha challenges without requiring proxies.

The failure is real and it's visible in prosopo customer data: teams that switched from reCAPTCHA to Friendly Captcha often switched again to Prosopo within six months, once form spam had crept back to pre-migration levels and the "invisible" verdict stopped correlating with human traffic.

What Prosopo does differently

Prosopo Procaptcha uses proof-of-work as one layer, not as the whole product. The full stack combines:

• Proof-of-work — silent, invisible, per-request compute toll. The layer this post is about.
• Behavioural analysis — cursor timing, scroll rhythm, typing cadence, SIMD-CPU signatures. Real humans move in ways that automation frameworks do not, and the difference is measurable per-session.
• Device fingerprinting — JA4 TLS fingerprinting, DNS resolver observation, stealth-headless detection, iOS App Attest, Android Play Integrity. Signals bot toolkits cannot spoof cleanly.
• Network reputation — datacentre-IP classification, residential-proxy detection, ASN and geographic risk.
• Adaptive access rules — per-endpoint policies that combine the above signals into a decision the operator can read as a named rule, not a black-box score.

Every verdict returns the specific rule that fired and the signals that fed it. If a request was blocked because the JA4 fingerprint matched a known scraping toolkit and the residential proxy had been used for 4,000 signup attempts this week, the operator sees exactly that in the portal. This is what the pure-PoW products cannot ship, because they have exactly one signal.

See the Prosopo Bot Protection product page for the full architecture, or the Invisible CAPTCHA product page for the widget-level view.

When PoW alone is enough {#when-pow-alone-is-enough}

Not every site needs a layered stack. Pure-PoW is genuinely the right answer for:

• Personal blogs and hobby-project comment sections. Spam volume is low, the traffic isn't valuable enough for a dedicated attacker, and the "no cookies" pitch matches the ethos.
• Contact forms on brochure sites with a handful of submissions a day. The cost of running a solver farm against the form is higher than any payoff.
• Comment threads on niche technical content where the audience runs privacy extensions and would treat a Google cookie as a bug.
• Non-commercial API endpoints where the traffic pattern is stable and the risk of abuse is reputational rather than monetary.

For anything with a signup incentive, a checkout, a scarce inventory drop, a login endpoint, a lead-generation form that gets forwarded to sales, or a paid API — PoW alone leaves signal on the table that a determined attacker will exploit. The right question is not "is PoW good?" but "is pure PoW enough for the value at stake?"

FAQs

What is a PoW CAPTCHA?

A proof-of-work CAPTCHA is a small computational puzzle that a visitor's browser must solve before a form or API accepts the request. Solving the puzzle takes a real user a fraction of a second and no interaction; solving it a thousand times for an automated attack costs real CPU time. It runs invisibly in the background — there is no image grid, no traffic-light click, no consent banner.

Which CAPTCHAs use proof of work?

Friendly Captcha and ALTCHA are the two mainstream products marketed as pure proof-of-work CAPTCHAs. Prosopo Procaptcha uses proof-of-work as one silent layer alongside behavioural signals, device fingerprinting and adaptive access rules. Cloudflare Turnstile and Google reCAPTCHA v3 do not use proof of work — they rely on passive fingerprinting and behavioural scoring.

Is a proof-of-work CAPTCHA enough on its own?

For a hobby site, a personal blog comment section or a low-value contact form, pure PoW is often enough — the traffic isn't valuable enough for an attacker to burn compute or hire a solver farm. For anything with a monetary value attached — a signup that gets a free trial, a checkout, a scarce inventory drop, a login endpoint — PoW alone is not enough. Dedicated attackers use GPUs, distributed botnets or commercial solver APIs that break the compute-cost asymmetry, and PoW cannot tell you who the requester is, only that they paid the compute toll.

Does a PoW CAPTCHA drain the battery on mobile?

A well-tuned PoW CAPTCHA is measured in milliseconds and milliwatts. A badly tuned one can take up to 20 seconds on an older phone and be felt as warmth or a brief slowdown. The trade-off is real: raising difficulty enough to slow down a determined attacker at scale also raises the cost for legitimate mobile users. Modern implementations adjust difficulty by device class to keep the invisible-user experience intact.

Is a proof-of-work CAPTCHA GDPR compliant?

Proof-of-work is fundamentally privacy-friendly: the puzzle is computed and returned inside the visitor's browser, and the server verifies a hash. No cookies, no cross-site identifiers, no personal data collected to run the challenge itself. That said, GDPR compliance depends on the whole product, not just the PoW step — where the verification endpoint is hosted, whether IP addresses are logged, and what other signals the vendor collects. Prosopo processes verification requests in the EU only, is cookieless by default and does not set third-party tracking identifiers. See GDPR-compliant CAPTCHA for the full data-handling posture.

How is PoW in a CAPTCHA different from PoW in Bitcoin?

The mechanism is the same; the target is different. Bitcoin's PoW is a consensus mechanism — miners compete globally to find a hash below a network-wide difficulty target, and difficulty is tuned so one block is found roughly every ten minutes across all miners. CAPTCHA PoW is per-request — each individual browser solves a tiny puzzle to enter, and difficulty is tuned so a real user solves it instantly while an operator at scale faces a real bill. Bitcoin puzzles are measured in petahashes and megawatts; CAPTCHA puzzles in milliseconds and milliwatts.