Browser support · Docs

Requirements #

A secure context: the page is served over HTTPS (or http://localhost during development).
fetch, MessageChannel and WebCrypto to check the signed site configuration. The configuration carries an Ed25519 and a P-256 signature: browsers without Ed25519 in WebCrypto use the P-256 one.
JavaScript. Without it no token can be obtained, so protected actions are refused by your server.

Call BlockAlt.supported() to check at runtime; execute rejects with unsupported_browser on a browser that lacks a feature.

Tested #

Every release runs the browser integration tests in Chromium, including a page that still pins the previous release of the script. Other engines are checked during the pilot; we publish results here once measured rather than claiming support we have not tested.

Visitors without support #

Decide per action what a visitor without a token should see. For a sign-up or contact form, show a short message with another way to reach you. Do not silently accept actions without a token: that is exactly what scripts do.

How long the work takes #

The script solves 8 small puzzles with a synchronous SHA-256, in up to four background workers, or on the main thread in short slices when your CSP forbids blob: workers. A site publishes a difficulty from 8 to 16 bits; visitors who ask for unusually many challenges, or a site under a surge, get a few extra bits. Measured in Chromium on a desktop, with 6× CPU throttling standing in for a low-end phone without workers:

Difficulty	Desktop with workers	Desktop, main thread	Low-end phone, main thread
12 (default)	< 0.01 s	< 0.01 s	0.02 s median, 0.04 s p95
14	< 0.01 s	0.02 s, 0.03 s	0.10 s, 0.17 s
16 (maximum)	0.02 s, 0.03 s	0.06 s, 0.11 s	0.40 s, 0.68 s

The script is a single file of a few kilobytes (gzip), with no dependencies. Proof of work shapes request rates and raises their cost; dedicated hardware solves it much faster than a phone, which is why per-visitor rate limits and rules matter as much as the difficulty.