Priced against volume, not against people.

Every challenge carries a computation the client has to finish before it can submit. A person pays it once and never notices.

Get started free Read the docs

How it works

The hundredth attempt costs as much as the first

There is no session discount and no cached pass to reuse. Abuse that depends on volume - card testing, stuffing, bulk signups - pays the cost on every single attempt.

It scales with the score

The required work is set per challenge and rises with risk, so ordinary traffic stays fast while automated-looking clients pay more.

Going faster does not help

Because the work is per request, throughput is exactly the thing being charged for. Speed makes the bill larger, not smaller.

What that means concretely

Each of these is a statement about how the product behaves, not a description of how we feel about it.

The computation is required before a solution is accepted, not after.

A failed attempt destroys the challenge; the next one is fresh and harder.

One visitor pays one proof. A client making 10,000 attempts pays 10,000.

Other features

Privacy and GDPR Risk scoring Accessible challenge Drop-in migration No Google dependency Per-site dashboard

Proof-of-work in PrivCaptcha: common questions

What proof-of-work actually does, and where it stops.

A person pays it once, at the low end of the scale, because ordinary traffic scores low. The cost is designed to be invisible in a single solve and painful only when someone wants thousands of them.

The puzzle prices a single attempt; the proof-of-work prices scale. Together they mean an attacker's bill grows with the size of the attack rather than staying flat.

The work scales with the risk level, and a normal mobile visitor sits at the bottom of that range. The heavy end is reserved for clients that have already failed repeatedly.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

Change two lines. Keep the rest.

10,000 verifications a month are free, and the integration is the one you already have.

Get started free See the migration guide