Try It Live

Below is a real mini guestbook. The verification widget is wired up to Capcat's production service running on Cloudflare Workers. Check the box and proof of work runs in the background of your browser; once it passes, the "Post message" button unlocks. On submit, the server first burns this cap-token through a real /siteverify check — only then is your message stored. Messages are public, showing the latest 10 by default.

Name (optional)

Message

Latest messagesup to 10 shown · each one passed Capcat verification

Loading…

What happens behind the scenes

1. The widget requests a challenge from the verification service, and the server issues a signed JWT.
2. Your browser solves two layers of challenge in the background: proof of work (solved in parallel across Web Workers), plus a dynamically generated browser instrumentation routine — confirming the solve happened in a real browser, not a script talking to the API directly (usually 1–3 seconds, entirely invisible to the user).
3. The solution is submitted back to the server for verification. Once it passes, a single-use cap-token is issued — your backend calls /siteverify with it to complete the final confirmation, and the token is burned on use. The "Post message" button on this page performs that exact step: only when the burn succeeds is your message stored and shown in the list.

INFO

This demo uses the same configuration as the production site: PoW + instrumentation checks (including headless browser detection) are on by default, and can be tuned per site in the console. The guestbook is demo-only and keeps just the most recent messages.

Scenario demos

Want to see Capcat dropped into a real page? The live demo collects three common scenarios, each gating a key action behind Capcat verification:

• Comments & messages — the post button is locked until verification passes, instantly making spam-bot flooding uneconomical.
• Account signup — every submission must first pay real compute cost and pass browser instrumentation, sharply cutting the throughput of bulk registration and credential-stuffing scripts.
• AI chat / expensive endpoints — verification runs before the call, raising the cost of abusing the endpoint without getting in the way of real users.

Ready to integrate Capcat into your own project? Head to Quick Start — it takes about 5 minutes.