Free plan · no card · 10,000 verifications a month · one script tag, one API call
Let real people in,
without making them prove it.
Every puzzle on your sign-up form loses some of the people who were ready to say yes. AttestOS replaces traffic-light puzzles on sign-up, login and contact forms with a small proof-of-work check that runs in the background, plus a server-side verify call shaped like reCAPTCHA's. Real people just submit the form.
- 10,000 verifications a month free
- Works with any backend
- Shaped like reCAPTCHA v2
- No cookies
- 0puzzles a real visitor ever sees
- 5 minlifetime of a single-use, domain-bound token
- 10kverifications a month on the free plan
- 1script tag, one hidden field, one verify call
01 — How it works
The page solves. The form carries the proof. Your server checks once.
The page solves
Our widget fetches a signed challenge and finds a nonce whose SHA-256 has enough leading zero bits. That takes a browser a fraction of a second; doing it millions of times costs a bot farm real compute.
The form carries a token
The solution is exchanged for a pass token that lives five minutes and is bound to your site key and domain. It lands in a hidden field, attestos-response.
Your server verifies once
Post the token and your secret key to /api/siteverify. The first call succeeds; any replay fails with timeout-or-duplicate.
<script src="https://attestos-edge.attestos.workers.dev/v1/attestos.js" async defer></script>
<!-- 2. the widget inside your form -->
<div class="attestos" data-sitekey="ao_site_…"></div>
// 3. your backend, Node 18+
const r = await fetch("https://attestos-edge.attestos.workers.dev/api/siteverify", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({ secret: process.env.ATTESTOS_SECRET,
response: req.body["attestos-response"] }),
});
const v = await r.json(); // { success: true, hostname, method, … }
if (!v.success) return res.status(400).send("Bot check failed");
02 — Who this is for
- 01
Product and growth teams
Someone on a phone, on a slow connection, gets the puzzle wrong twice and closes the tab. You paid to bring them there.
With AttestOS: the check runs quietly while they type. They press the button and they are in.
- 02
Whoever owns the login page
A Monday morning of fake accounts and password-stuffing attempts, and a CAPTCHA that annoys customers more than it slows the attackers.
With AttestOS: every automated attempt costs the attacker compute, tokens are single-use and domain-bound, and Pro shows you how risky each solve was.
- 03
Publishers and documentation sites
AI crawlers read everything you wrote, every day, and you were never asked.
With AgentPass: you decide per crawler — allow it, block it, or answer with your own payment link. Your work, your terms.
03 — One free core, four paid modules
Every plan includes the free core. Paid modules combine.
Monthly on Whop. Add only the module whose sentence you recognise.
Ghost-PoW core
Bots stopped, and real people never see a puzzle.
- Invisible proof-of-work widget
- Server-side verify, single-use tokens
- Domain lock and an AI-crawler rule check
- Passkeys for up to 50 users
IntegrityRuntime Pro
Know how risky every solve was, and tighten only when it matters.
- Automation signals turned into a risk score on every verify
- Adaptive difficulty during surges
- Slack and Discord alerts
- Audit export
Hardware Gateway Pro
Trusted devices walk straight in. Everyone else still gets through.
- Private Access Tokens (Privacy Pass, RFC 9576–9578)
- Supporting Apple devices skip the solve entirely
- Unlimited passkeys
- Everyone else falls back to Ghost-PoW
AI crawlers either pay you or stay out.
Decide per crawler: allow, block, or answer HTTP 402 with your own payment link. Crawler claims are checked against the operators' published IP ranges, and you can sell metered agent keys.
Everything, at a size where you stop thinking about limits.
All modules, 300,000 verifications a month, 25 sites.
04 — What proof-of-work does, honestly
No tool can promise zero bots.
What it does: makes every automated submission cost CPU time, which kills cheap mass sign-ups, credential stuffing at scale and form spam floods. Asks nothing of real visitors: no puzzles, no clicks, no third-party tracking cookies.
It is not identity. A patient attacker with real compute can still pay the price — so keep server-side rate limits, and add the risk score or passkeys where it matters.
We report what we check, and the verify response tells you how a token was earned.
Does it replace reCAPTCHA v2 / hCaptcha one to one?
Yes for the integration shape: a script, a hidden field, and a siteverify call returning success, challenge_ts, hostname and error-codes. The difference is that visitors see nothing.
What if AttestOS is down or my quota runs out?
You decide. The docs show a fail-open pattern for quota-exceeded and network errors, so your sign-ups never stop because of us.
Is visitor data sent anywhere?
The challenge is served from Cloudflare's edge. On paid IntegrityRuntime plans the widget also sends a few browser facts to compute the risk score. No cookies, no cross-site tracking.
How do I pay?
Checkout runs on Whop. Buy with the same email as your AttestOS account and the plan attaches automatically once your email is confirmed.
Run the free scanner on your sign-up page.
It shows which CAPTCHA you run today, how your robots.txt treats AI crawlers, and which security headers are missing.