How Scraping Pipelines Handle Friendly Captcha
Friendly Captcha is a privacy-first CAPTCHA solution built in Germany, designed specifically to comply with GDPR without requiring user interaction or sharing data with third parties like Google. Its core mechanism — a proof-of-work puzzle computed silently in the browser — makes it different from both reCAPTCHA and hCaptcha. Understanding this difference is important for correctly configuring scraping pipelines that encounter it.
This article covers how Friendly Captcha’s proof-of-work mechanism works, what it protects against, how it compares to image-challenge CAPTCHAs, and what scraping pipelines need to handle it. For structured data from protected sources, see our API Marketplace. See also our articles on reCAPTCHA and hCaptcha for comparison.
How Friendly Captcha’s Proof-of-Work Mechanism Works
Unlike CAPTCHAs that ask users to identify images, Friendly Captcha uses a client-side computational puzzle:
| Step | What happens | Automation implication |
|---|---|---|
| 1. Widget loads | Browser downloads the Friendly Captcha JavaScript widget and requests a puzzle from the FC server | Requires JavaScript execution — plain HTTP clients cannot proceed |
| 2. Puzzle computation | The widget runs a SHA-256 based hash puzzle in a Web Worker; difficulty is adjustable by the site owner | Takes seconds to minutes depending on configured difficulty; browser must remain active |
| 3. Solution submission | Completed puzzle solution is stored in a hidden form field and submitted with the form | The form cannot be submitted without a valid solution; solution is verified server-side |
| 4. Server verification | Site server verifies the solution with Friendly Captcha’s API before processing the form | Fabricated solutions are rejected; only genuinely computed solutions are valid |
The key distinction: Friendly Captcha is not scoring behavioral signals or collecting fingerprints for a risk model. It is verifying that the client completed a specific computational task. A headless browser that executes the JavaScript and waits for the puzzle to complete will produce a valid solution — no image recognition, no behavioral simulation, and no external solving service required.
What Friendly Captcha Protects Against (and What It Does Not)
The proof-of-work model has a specific protection profile:
- It stops plain HTTP clients. A client that cannot execute JavaScript cannot request a puzzle from the FC server, cannot compute a solution, and cannot submit a valid form. This blocks the simplest automated attacks.
- It imposes computational cost at scale. A single puzzle computation takes a few seconds. Running thousands of form submissions per minute requires thousands of simultaneous browser instances each spending CPU time on puzzle computation. This makes large-scale abuse expensive, even though individual puzzle solving is straightforward.
- It does not perform behavioral biometric analysis. Unlike reCAPTCHA or DataDome, Friendly Captcha does not score mouse movement, browser fingerprints, or IP reputation. A headless browser that computes the puzzle correctly will pass — regardless of whether it has a residential IP or a clean fingerprint history.
- It is not a comprehensive anti-bot layer for scraping. Friendly Captcha protects forms — contact forms, login pages, sign-up flows. It is not deployed on general content pages. A scraping pipeline that reads product data or listing pages will rarely encounter Friendly Captcha unless those pages include a form with the widget embedded.
Where Friendly Captcha Appears and Who Uses It
Friendly Captcha is used primarily by European organizations that have compliance requirements around data protection — government agencies, educational institutions, healthcare providers, B2B software companies, and nonprofits. It is particularly common in Germany, the Netherlands, and other EU markets where GDPR compliance is strictly enforced and using Google reCAPTCHA raises data protection concerns.
For scraping pipelines, Friendly Captcha is most commonly encountered on:
- Contact and inquiry forms on EU corporate or government sites
- Registration forms on EU platforms that have moved away from Google CAPTCHA
- Login flows on privacy-focused products
It is not commonly found on the content pages (product listings, search results, data tables) that most enterprise scraping programs target. The more likely encounter is when a pipeline needs to submit a form — for example, accessing data that requires a search query submitted through a protected form.
How Webparsers Handles Friendly Captcha
- We use headless browsers that execute the proof-of-work puzzle natively. When Friendly Captcha is encountered, our headless browser runs the JavaScript puzzle computation and waits for completion before submitting the form. No external solving service is required — the browser does the work itself.
- We account for computation time in collection scheduling. Friendly Captcha puzzles take seconds to minutes depending on configured difficulty. Collection pipelines that encounter Friendly Captcha are scheduled with appropriate timeouts to allow puzzle completion without triggering false-positive failure detection.
- We identify whether Friendly Captcha is on the data page or on a prerequisite form. If Friendly Captcha guards a search form that produces data pages, the pipeline completes the form with puzzle solution to access the data. If data pages are directly accessible without form submission, the CAPTCHA is irrelevant to collection.
- We monitor puzzle completion times per source. If a site increases puzzle difficulty (which site owners can configure), completion times increase and can affect pipeline throughput. We track this as a per-source metric. See our article on scraping monitoring and alerting.
- Data from Friendly Captcha-protected sources is available through our API Marketplace where supported. See API Marketplace.
Discuss Your CAPTCHA-Protected Source Requirements
Frequently Asked Questions
How does Friendly Captcha work?
Friendly Captcha runs a proof-of-work puzzle in the browser — a SHA-256 based hash computation that runs in a Web Worker. When the puzzle is solved, the solution is stored in a hidden form field and submitted with the form. The server verifies the solution with Friendly Captcha’s API before processing the submission. No user interaction is required — the puzzle runs automatically in the background. Difficulty is configurable by the site owner and affects how long computation takes.
Is Friendly Captcha easier to handle than reCAPTCHA?
For scraping pipelines using headless browsers, yes — Friendly Captcha requires JavaScript execution and computation time, both of which headless browsers provide natively. No CAPTCHA solving service, image recognition, or behavioral simulation is needed. The main constraint is computational overhead per form submission. reCAPTCHA and hCaptcha are more complex because they score behavioral signals and browser fingerprints in addition to requiring challenge completion.
Is Friendly Captcha GDPR compliant?
Yes — GDPR compliance is Friendly Captcha’s primary value proposition. Unlike reCAPTCHA and hCaptcha, which send client data to Google’s and Intuition Machines’ servers respectively, Friendly Captcha processes the proof-of-work puzzle without collecting personal data and is hosted on EU infrastructure. This makes it the preferred CAPTCHA solution for European organizations with strict data protection requirements who cannot use Google or US-hosted CAPTCHA services.
Does Friendly Captcha protect against all scraping?
No. Friendly Captcha protects forms — it prevents form submissions without valid proof-of-work solutions. It does not protect content pages that are directly accessible without form submission. A scraping pipeline that reads publicly accessible content pages is unaffected by Friendly Captcha unless that content is only accessible through a Friendly Captcha-protected form. For general content scraping, Friendly Captcha is not a meaningful obstacle compared to anti-bot systems like Cloudflare or Akamai.