Observed Signal · May 11, 2026 · Product Launch · Source: DEV Community · Impact: 3/5 · Sentiment: Positive

Proof-of-Work CAPTCHA Removes Cookies

Executive Signal Summary

A Dev.to engineering post (published 2026-05-11) describes building captchaapi.eu, a cookie-free CAPTCHA that replaces cross-site profiling and cookies with a client-side proof-of-work (PoW) challenge. The protocol issues a seed and difficulty target; the client finds a nonce via SHA-256 iterations and submits it for server verification. The implementation uses server-side Redis (2-minute TTL) for challenge state and pseudonymised IP hashing for short-term rate limiting, runs PoW in a Web Worker to avoid UI blocking, and ships a small open-source widget (~19 KB minified, ~7 KB gzipped). The author positions this as a GDPR-friendlier alternative to solutions that rely on cross-site cookies and global risk scoring (e.g., Google reCAPTCHA), while noting trade-offs versus ML-based behavioural scoring and advanced botnets.

Polaris7 AgentPolaris7 Strategic Assessment
High Confidence

Presents a privacy-preserving, technically viable alternative to cookie-based CAPTCHAs that reduces cross-site profiling and GDPR/compliance overhead for EU SaaS — relevant to identity, consent and bot mitigation strategies in the ecosystem, but originates from a small project rather than a major platform.

SIGNAL RADAR

Track Google Signals & Market Shifts in Real-Time

Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.

Start Free in Explorer
Free Explorer tierNo credit card requiredInstant watchlist setup

Key Takeaways & Evidence Grounding

  • Author built captchaapi.eu as a cookie-free CAPTCHA service using a proof-of-work protocol
  • PoW protocol: server issues seed + difficulty; client iterates SHA-256(seed || counter) and submits nonce for server re-hash verification
  • Server-side implementation uses Redis for ephemeral challenge state with a 2-minute TTL and pseudonymised IP hashes (SHA-256(IP || server-secret-salt)) for rate limiting
  • Widget size ~19 KB minified and ~7 KB gzipped; PoW runs inside a Web Worker to avoid freezing the main thread
  • Measured median PoW solve times: ~20 ms on Mac mini M4 and ~63 ms on iPhone, with total end-to-end ~234 ms driven by network RTT
  • Free tier of captchaapi.eu covers 5,000 challenges per month
Primary Source Grounding & Direct Attribution
Direct Origin Attribution
Primary Reporting: DEV Community•Published: May 11, 2026
Original Coverage Title: “CAPTCHA without cookies: a proof-of-work approach”

Related Market Signals & Shifts

Recent verified developments and strategic activity across this market segment.

Large Language Models (LLM) & AIJun 8, 2026

Claude + Playwright Automate CAPTCHA-Heavy Signups

A developer describes an AI-powered browser agent that uses Anthropic's Claude as the reasoning layer and Playwright as the execution layer to automate account signups on CAPTCHA-heavy sites. The agent sends a structured DOM snapshot (not screenshots) to Claude to decide the next single browser action, uses an init script to patch navigator/browser fingerprints, and runs a prioritized CAPTCHA decision tree (including 2captcha and anti-captcha services). The system logs strategy outcomes to a SQLite `browser_memory` table, learns across sessions, and relies heavily on residential proxies for IP reputation. The author packaged the implementation into a reusable "Claude Browser Agent Starter Kit" available on Payhip and reports measured bypass rates across protection vendors after ~40 attempts.

Read assessment
Content Delivery Network (CDN)Aug 22, 2026

Fix: 'Enable JavaScript and cookies to continue' Error

A technical how-to explaining why the message 'Enable JavaScript and cookies to continue' appears (typically when Cloudflare or similar security proxies detect missing JavaScript execution or cookies) and practical fixes for end users and developers. The article describes Cloudflare’s JavaScript challenge and verification cookies (e.g., __cf_bm, cf_clearance), recommends using headless browsers with JS/cookie support (Playwright, Selenium, Puppeteer) for automation, warns against raw HTTP requests (requests/curl) for sites enforcing JS challenges, and notes alternative but fragile approaches such as using cloudscraper. Publication date: 2026-08-22.

Read assessment
AI & AgentsOct 8, 2026

Google launches unified agentic AI for Gemini

At a Google Cloud event on Thursday, Google announced it is bringing agentic AI to its Gemini assistant, launching a unified agent that can autonomously plan and execute tasks on behalf of users. Aimed initially at businesses, the agent can connect to internal systems and external tools, use custom skills, and even choose from third-party models like Anthropic's Claude. It will have its own Workspace account with an email address, and will write its own audit trail. Early testers include On, Shopify, and PayPal. Gemini has over 1 billion monthly active users, and nearly 90% of Fortune 100 companies use Gemini Enterprise.

Read assessment

Track Real-Time Market Signals & Shifts

Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.