Skip to main content
Ribaunt is a stateless proof-of-work CAPTCHA library for Node.js and modern browsers. Your server issues challenges as signed JWTs, the browser widget solves the PoW puzzle, and your server verifies the submitted proof — all without touching a database. Drop it in front of any form, sign-up flow, or API endpoint to stop bots while keeping the experience smooth for real users.

Introduction

Learn what Ribaunt is, how proof-of-work CAPTCHA protects your app, and why stateless verification makes deployment simple.

Quickstart

Install Ribaunt, configure your secret, add two server endpoints, and embed the browser widget in under five minutes.

Server Setup

Full Express server example with challenge and verify endpoints, replay protection, and TypeScript types.

API Reference

Complete reference for createChallenge, verifySolution, solveChallenge, and all configuration options.

​
Get up and running in four steps

1

Install Ribaunt

Add the package to your project with your preferred package manager.
npm install ribaunt
2

Set RIBAUNT_SECRET

Add a strong, randomly generated secret to your server environment. Ribaunt uses it to sign and verify JWT challenge tokens.
RIBAUNT_SECRET="replace-with-a-long-random-secret"
3

Add server endpoints

Create a GET /api/captcha/challenge endpoint that issues challenges and a POST /api/captcha/verify endpoint that validates solutions.
import { createChallenge, verifySolution } from 'ribaunt';

app.get('/api/captcha/challenge', (_req, res) => {
  const challenges = createChallenge(5, 4, 120);
  res.json({ challenges });
});

app.post('/api/captcha/verify', async (req, res) => {
  const { tokens, solutions } = req.body;
  const valid = await verifySolution(tokens, solutions);
  if (!valid) return res.status(400).json({ success: false });
  return res.json({ success: true });
});
4

Drop in the widget

Add the web component to your HTML page. It fetches a challenge, solves it in the browser, and emits a verify event when done.
<script type="module" src="/node_modules/ribaunt/dist/widget-browser.js"></script>

<ribaunt-widget
  challenge-endpoint="/api/captcha/challenge"
  verify-endpoint="/api/captcha/verify"
  auto-verify="true"
></ribaunt-widget>

<script>
  document.querySelector('ribaunt-widget')
    .addEventListener('verify', (e) => {
      console.log('Verified!', e.detail.solutions);
    });
</script>