CYGcaptcha / v1

Bots pay the cost.
Humans just tap.

A puzzle-free captcha with its own API. Cryptographic proof-of-work, behavior scoring and signed tokens — no image grids.

Invisible mode (v3) — no checkbox

No name, no email, no site key and no domain registration. Works on any website, including localhost.

Checkbox mode

Protected by CYGcaptcha

Challenge

Server issues an HMAC-signed challenge bound to the client, valid 2 minutes.

Prove

Browser solves SHA-256 proof-of-work and records pointer, timing and automation signals.

Score

Server checks the proof and scores behavior. Pass returns a signed token.

Siteverify

Your backend posts the token to confirm before accepting the form.

API

POST /api/public/captcha/challenge
→ { challenge, salt, difficulty, expires }

POST /api/public/captcha/verify
{ challenge, nonce, signals }
→ { success, token, score }

POST /api/public/captcha/siteverify
{ token }
→ { success, score, challenge_ts }

Verify on your server

// Node / any backend
const r = await fetch("https://YOUR-DOMAIN/api/public/captcha/siteverify", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ token: req.body.captchaToken }),
}).then(r => r.json());

if (!r.success || r.score < 0.5) return res.status(403).end();