I'm excited to announce the release of Captcha - HashCash version 5.5.0 – a major upgrade that finally banishes one of the last remaining pain points using a web worker: UI freezes during high-difficulty proof-of-work calculations.
If you've ever cranked up the difficulty (or enabled "punish" mode for detected bots) and watched your form page turn into a beach ball spinner... this update is for you. Joomla deserves a world-class CAPTCHA, and this plugin is the real deal.
What Was the Problem?
Captcha - HashCash has always been a true Hashcash-style proof-of-work system: Your browser grinds away finding a nonce that makes the hash start with enough leading zeros. It's invisible, privacy-friendly, and brutally effective against bots.
But... all that hashing happened on the main JavaScript thread – the same thread responsible for rendering your page, handling clicks, and keeping everything snappy.
Result? At higher difficulty levels or using the GPU resistant algorithms, the page could freeze for seconds – or even minutes on slower devices. Users might think the form is broken, and mobile battery life took a hit. The recent PBKDF2 algorithm additions made this problem even more noticeable.
Implementing a Web Worker
In version 5.5.x (culminating in 5.5.2), we completely refactored to implement multithreading - putting the heavy lifting in a separate thread:
- Proof-of-work mining now runs in a dedicated Web Worker – a separate background thread that doesn't touch the main UI thread at all.
- The worker is created lazily (only when needed) and terminated automatically once a solution is found – saving memory and CPU.
- Mining starts only once per page load (or restarts only if punish mode escalates difficulty).
- Added Link rel="preload" header for the worker script – it's fetched immediately on page load, so when mining begins, there's zero network delay.
Real-World Performance Wins
- No more freezes: Even at extreme difficulty (even punish mode), your form page stays fully responsive. Users can keep typing or scrolling while the background thread grinds away.
- Faster start times: Preloading means mining begins instantly on first interaction.
- Battery-friendly: Work stops as soon as a solution is found – no lingering threads.
- Mobile bliss: Tested on low-end devices – smooth as ever.
Why This Matters for Bot Protection
Bots don't care about UI freezes – they'll grind forever. But now you don't have to suffer for strong protection. Crank that difficulty, enable punish mode with confidence, and watch bots burn CPU cycles while your human visitors enjoy a seamless experience.
This upgrade keeps Captcha - HashCash as one of the most faithful modern implementations of Adam Back's original 1997 Hashcash idea – with real verifiable stamps, optional memory-hard modes, and now buttery-smooth performance.
