Glossary · Email & infrastructure
Proof-of-work challenge
A proof-of-work challenge requires a client to perform a small, verifiable computation before a request is accepted — cheap for one user, expensive enough at scale to make bulk automated abuse uneconomical.
The term is most widely known from cryptocurrency mining, where proof-of-work secures a blockchain by making block creation computationally costly — that context is unrelated here. In bot protection, the same core idea is repurposed defensively: the server issues a cryptographic puzzle (commonly, find an input that hashes below some target), the client’s browser solves it, and the server verifies the answer in near-zero time. One human clicking a login form barely notices the delay; a bot farm submitting thousands of requests per second has to pay that computational cost thousands of times over.
Proof-of-work’s advantage over behavioral or fingerprint-based bot detection is that it requires no tracking data at all — no cookies, no device profile, no history of the visitor. It only requires the current request to prove it did the work, which makes it verifiable statelessly: no database of past behavior is needed to check the answer, only the cryptographic proof attached to this one request.
Ciphera Captcha runs proof-of-work invisibly in a background Web Worker, with difficulty that adapts per-IP to request volume, so legitimate visitors see nothing while bulk automated traffic hits a rising computational cost.