HashCash – Proof of Work CAPTCHA

FAQ

Does this replace reCAPTCHA / hCaptcha?

Yes. HashCash requires no third-party service, no API key, and sends no data to external servers. If you’re using reCAPTCHA or hCaptcha specifically to avoid tracking your users, HashCash is a direct replacement.

What does the user actually see?

While the proof-of-work calculation runs, a brief “Securing this form…” message appears and the submit button is temporarily disabled. When the calculation completes — usually within seconds at default settings — the button re-enables and the indicator disappears. There is nothing for the user to click, solve, or interact with.

Do logged-in users see the indicator?

No. Logged-in users are exempt from HashCash verification entirely.

Will it slow down my site?

No. The proof-of-work calculation runs in a Web Worker (a background browser thread) and only starts when the user interacts with the form. Your page load time is not affected.

What is Argon2id and should I use it?

Argon2id is the current gold standard for memory-hard cryptographic hashing — it’s specifically designed to be expensive for bots running at scale while remaining fast enough for individual users. It requires the PHP sodium extension (available by default in PHP 7.2+). If your server supports it, it’s the strongest option available. SHA-256 remains the default for maximum compatibility.

What is “bot punishment mode”?

When suspicious behavior is detected (automated form submission patterns, headless browsers, CDP runtime signatures), HashCash can either silently fail or make the proof-of-work impossible to solve. Punishment mode chooses the latter — the bot wastes significant compute resources without knowing it was detected, while legitimate users are unaffected.

Does it work with Contact Form 7?

Yes, automatically. If the user is not logged in, HashCash is injected into every CF7 form without any configuration. You can also use the [hashcash] shortcode for manual placement.

Is it accessible?

Yes. The indicator is visual feedback only — it does not interfere with screen readers or keyboard navigation. There is no interactive challenge of any kind.

What happens if the proof-of-work expires?

Each proof-of-work calculation is timestamped. On submission, the server verifies that timestamp is within 30 minutes of the current time — this prevents replay attacks, where a bot captures a valid solution and reuses it repeatedly. HashCash automatically refreshes the calculation before it expires, so users who leave a form open for an extended period never encounter a validation failure on submission.

Is this related to the original HashCash email anti-spam system?

Yes. HashCash as a concept dates to 1997 — it was originally designed to combat email spam using proof-of-work. This plugin applies the same principle to web forms, using modern cryptographic algorithms where the original used SHA-1.