Krynox Captcha is a privacy-first, proof-of-work CAPTCHA. The browser solves a small cryptographic challenge in the background — invisible to humans, expensive for bots — so real users are never stopped by image puzzles. For suspicious traffic, Krynox adaptively adds an accessible code challenge (image + audio) and server-side risk signals.

Built ALTCHA-compatible at the wire level, and layered with verified-agent and attested-human rails, an explainable risk engine (every verification returns reason codes), a self-tuning Autopilot, per-tenant anomaly detection, a behavioural signature, an on-device content classifier, optional LLM security rules, and a cross-tenant threat-intelligence network.

Our server SDKs are open-source (MIT) — verify Krynox responses on any stack. One identical contract across all seven: success + risk score, explainable reasons, a verified agent (Web Bot Auth) and attested human (Private Access Token / passkey), automatic retries with per-verify idempotency, and classify() / feedback().

Drop-in integrations that wire both the widget embed and server-side verification — no glue code:

The <krynox-captcha> widget and the platform core (control plane + data plane) are proprietary and closed-source. Use them via the hosted service at krynox.net — no repo access needed.

<!-- 1. Load the widget -->
<script async defer src="https://cdn.krynox.net/widget/krynox-captcha.js" type="module"></script>

<!-- 2. Drop it into your form -->
<form action="/signup" method="POST">
  <krynox-captcha challenge="https://api.krynox.net/challenge?sitekey=kcpt_live_xxx"></krynox-captcha>
  <button type="submit">Create account</button>
</form>

// 3. Verify server-side with your secret key
import { KrynoxCaptcha } from '@krynox/captcha';

const krynox = new KrynoxCaptcha(process.env.KRYNOX_SECRET);
const r = await krynox.verify(form.get('krynox-captcha'), req.ip);
if (!r.success) return res.status(400).json({ error: 'captcha failed' });
if (r.risk === 'high' || r.reasons?.includes('tor-exit')) { /* add friction */ }

• Frictionless — invisible background proof-of-work; no image puzzles for real users.
• Privacy by design — no tracking cookies, no fingerprinting; geolocation runs locally, so end-user IPs are never sent to a third-party lookup service.
• Explainable — every verification returns stable reason codes ("why was this flagged?") — the black box becomes a debuggable product.
• Adaptive — risk-based step-up, a self-tuning Autopilot that learns each site's PoW difficulty from its own outcomes, and per-tenant anomaly detection with automatic step-up.
• Agent-aware — purpose-built for the agentic web: tell a malicious bot from a user's own AI agent via Web Bot Auth signatures, with per-site allow / challenge / block policy.
• Zero-friction humans — device-attested Private Access Tokens and WebAuthn passkeys let a proven human skip the proof-of-work entirely.
• A moat that compounds — a cross-tenant reputation network: an IP flagged across many tenants is high-confidence intel, surfaced right in your dashboard.
• Drop-in — ALTCHA-compatible wire format; 7 server SDKs + 8 framework plugins.
• Accessible — engineered to exceed WCAG 2.2 AA, with an audio code-challenge fallback.

• General, security & privacy — support@krynox.net
• Docs & API reference — docs.krynox.net