Skip to main content
ALTCHA®

How ALTCHA Works

ALTCHA verifies visitors with a proof-of-work challenge instead of image puzzles or behavioral tracking. This page covers the concept at a high level — for the underlying cryptography, see Proof of Work.

The short version

  • A visitor loads your form → the widget silently computes a small cryptographic challenge in the background.
  • Real users never see anything — it solves automatically, and the form submits normally.
  • Bots can't solve challenges cheaply at scale, so automated abuse gets filtered out without ever showing anyone a puzzle.
  • Your server verifies the solved challenge before accepting the submission — no third-party service call required.

This core flow is the same whether you're running the free, open-source widget or Cloud/Sentinel. Cloud and Sentinel add a layer on top: evaluating signals about each request and adapting the challenge accordingly — see below.

Three moving parts

An ALTCHA integration has three pieces working together:

  1. Widget — embedded in your form, computes the proof-of-work challenge in the browser.
  2. Challenge generation — your server (or ALTCHA Sentinel) issues a fresh, single-use challenge to the widget.
  3. Verification — your server checks the solved challenge before accepting the submission.

See Quick Start for the step-by-step setup of all three.

Open-source core: always frictionless

The free, open-source CAPTCHA widget and libraries run the same silent proof-of-work challenge for every visitor. There's no risk evaluation and no interactive fallback — the challenge itself is the protection, cheap for your server to verify but costly to fake at scale. This is what you get with the open-source core on its own.

Cloud and Sentinel: adaptive, risk-based escalation

ALTCHA Cloud and Sentinel add a risk-evaluation layer on top of the same proof-of-work engine, using threat intelligence and other signals to score each request:

  • Low risk — same invisible proof-of-work as the open-source core. Nothing to click, nothing to look at.
  • Elevated risk — if a request looks automated, the challenge escalates to a quick, accessible interactive check instead of an image puzzle.

This adaptive escalation — deciding when to ask more of a visitor — is a Cloud/Sentinel capability, not part of the open-source core. See Open Source vs. Paid for a full breakdown of what's free and what's paid.

Why proof-of-work instead of puzzles

A proof-of-work challenge is asymmetric by design: cheap for your server to verify, but it costs real computation to solve — at scale, that cost adds up for automated abuse in a way a single solved puzzle never does. It also requires no personal data, cookies, or cross-site tracking to make the call, unlike systems that score visitors using browsing history or device fingerprinting.

Going deeper

Start typing to search...

↑ ↓ Navigate ↵ Select