Proof of Work (PoW)

Overview

Proof of Work, or PoW (a small calculation your device must finish before sending), is a technique that raises the cost of mass requests by requiring whoever sends a request to do a certain amount of computation. It is widely known from Bitcoin mining, but it is also applied as a spam countermeasure for web services. The amount of computation is kept low enough that it isn't a burden when a person sends one question, while for a bot trying to send many times, the required computation piles up, which works to lower the cost-effectiveness of the attack.

How it works

The basic mechanism of PoW is that the server issues a random string called a "challenge," and the client finds a "nonce" that meets a specific condition for that challenge. For example, the condition might be that "the SHA-256 hash of the challenge plus the nonce starts with N zero bits."

By adjusting the value of N (the difficulty), you can control how long the calculation takes. The difficulty is tuned to a level that's hard to notice for a single send by a person, which keeps bots away while limiting the effect on the user experience.

How it differs from CAPTCHA

CAPTCHA is a technique that tells people and bots apart with a visual test (recognizing images or typing letters). PoW imposes a computational cost. CAPTCHA asks users to do something explicitly, so it creates that much extra effort on the user's side. On mobile, the work of selecting images becomes more of a burden, and it can be a reason people give up partway through sending.

PoW runs automatically in the background, so it doesn't ask users to do anything explicitly. However, PoW is not a technique that decides "person or bot" but one that "makes mass requests pointless," so it has limited effect against small-scale harassment by hand. For that reason, it is designed as part of a layered defense combined with honeypots and rate limiting.