Captcha
Bot protection that adapts from an invisible computation to a solvable puzzle, keeps no state, and sets no cookie.
Ciphera Captcha keeps automated traffic off endpoints that cost something to abuse — sign-up, sign-in, password reset, contact forms. It is the service that already stands in front of Ciphera's own public endpoints, and it is available for your applications by arrangement rather than self-serve signup.
How a visitor experiences it
Most people never see anything. The default challenge is proof of work: the browser is handed a short SHA-256 search to run in the background, and it finishes while the person is still reading the form. There is nothing to click and nothing to interpret.
When the risk signals say more proof is needed, it escalates to a puzzle — a drag-to-fit shape rendered as SVG, which resists the OCR and image models that read a distorted-text captcha for a few thousandths of a cent. Every puzzle ships an audio alternative, so the escalation does not become a wall for anyone who cannot solve it visually.
Escalation is the part worth understanding: the difficulty is a response to how the request looks, not a fixed setting. A visitor who looks ordinary pays nothing; an automated client pays repeatedly, and pays more each time.
What it keeps
Nothing. The service is stateless by construction: a challenge is an HMAC-signed value, verified by recomputing the signature rather than by looking anything up, so there is no database of challenges, no session, and no row tying a solve to a person. No cookie is set, and nothing is readable across sites.
A successful solve returns a short-lived JWT. The application you are protecting either validates that token against the service or verifies it with a shared secret, and then throws it away. That token is the entire record that a challenge happened.
Fitting it to an application
The verification service is a small stateless Go service you point at; the
widget is a React component published in
@ciphera-net/facet, the same design
system the Ciphera frontends are built from, so it inherits their styling and
accessibility behaviour rather than arriving as a foreign box.
Ciphera ID uses it exactly this way: not on every sign-in, but on registration and after failed attempts, which is the shape most applications want.
Note
There is no self-serve signup for Captcha today, and no public API key you can mint from a dashboard. Getting it in front of your own endpoints starts with a conversation — contact us.
Elsewhere
- Bot filtering in Pulse — a different thing with a similar name: how Pulse keeps bots out of your analytics.
- Ciphera Captcha on ciphera.net — the product overview.
- Service status — live operational state.
- Changelog — release notes as features ship.