Aswanth R

Posted on Oct 30

Introducing BioKyn: Bot Protection Without CAPTCHA Puzzles

#programming #opensource #webdev #showdev

Bot protection that respects your users.

Today, I'm excited to introduce BioKyn — an open-source, self-hosted bot mitigation system designed to protect websites without forcing visitors through traditional CAPTCHA puzzles.

Website: https://biokyn.js.org/

GitHub: https://github.com/biokyn/biokyn

The problem with traditional CAPTCHA

We've all experienced it.

You're trying to access a website, and suddenly you're asked to:

Identify traffic lights.
Select buses.
Click every bicycle.
Solve puzzles just to continue browsing.

These challenges create friction for legitimate users, introduce accessibility barriers, and often depend on third-party services that collect additional information.

I wanted to explore a different approach.

What if bot protection could happen without making users prove they're human through puzzles?

That's the idea behind BioKyn.

What is BioKyn?

BioKyn is a free, open-source, privacy-focused alternative to traditional CAPTCHA-based bot protection.

Instead of relying on visual puzzles, BioKyn uses cryptographic verification and server-verifiable computational work to mitigate automated abuse.

Its design principles are:

Privacy first: No cookies, browser fingerprinting, or cross-site identifiers for verification.
Invisible by default: No traditional CAPTCHA puzzles or third-party verification widgets.
Accessible: The default verification lane doesn't require pointer interaction, and alternative verification paths are provided.
Self-hosted: Your verification infrastructure and data stay under your control.
Developer-friendly: Express and Next.js integrations, plus a compatible site verification endpoint.

How does it work?

BioKyn uses multiple verification mechanisms.

1. Argon2id Proof-of-Work

The browser performs computational work bound to a server-issued challenge.

The server independently verifies the result before granting a token.

2. RFC 9497 VOPRF

BioKyn uses the ristretto255-SHA512 VOPRF construction from RFC 9497.

This allows the issuance of cryptographically verifiable tokens while providing blindness properties that help prevent the issuer from linking issuance inputs to redeemed tokens.

3. WebAuthn

BioKyn also supports a WebAuthn verification lane using credentials registered with the server.

4. Behavioural signals

Browser kinematics, motion telemetry, and tamper signals can contribute to risk assessment.

An important architectural decision: these signals are advisory. They cannot independently grant verification tokens.

Only server-verifiable evidence grants tokens.

The architecture

BioKyn is organized into several packages:

Package	Responsibility
`@biokyn/protocol`	Cryptographic protocol, VOPRF, token formats, PoW and kinematics
`@biokyn/client`	Browser-side verification and token issuance
`@biokyn/server`	Verification, challenge issuance, WebAuthn and integrations
`@biokyn/core`	Standalone HMAC-token primitives
`@biokyn/shim`	Migration compatibility helpers

It also includes Redis-backed security stores, replay protection through nullifiers, rate limiting, key rotation, and Express/Next.js adapters.

Get started

Install the packages:

npm install @biokyn/server @biokyn/client

Server-side example:

import {
  BioKynVerifier,
  biokynExpress,
  generateServerSecrets,
  createRateLimiter,
  MemoryRateLimitStore
} from '@biokyn/server';

const verifier = new BioKynVerifier({
  issuer: 'verify.example.com',
  ...generateServerSecrets(),
  sites: [{
    origin: 'http://localhost:3000',
    secret: process.env.BIOKYN_SITE_SECRET!
  }],
  pow: {
    memoryKiB: 19456,
    iterations: 1,
    parallelism: 1,
    difficultyBits: 8
  }
});

app.use(express.json());

app.use(biokynExpress(verifier, {
  basePath: '/biokyn',
  rateLimit: createRateLimiter({
    store: new MemoryRateLimitStore()
  })
}));

Browser-side example:

import { requestInclusiveToken } from '@biokyn/client';

const { token } = await requestInclusiveToken({
  basePath: '/biokyn',
  expectedPublicKey
});

Your backend can then submit the token to BioKyn's /siteverify endpoint.

For production deployments, configure persistent secrets, shared Redis stores, trusted proxies, TLS, and key rotation. See the deployment documentation before going live.

What's next?

BioKyn is an evolving open-source project.

Some of the directions I'm exploring include:

More framework integrations: Fastify, Hono, NestJS and Cloudflare Workers.
Privacy Pass interoperability.
Additional shared-store backends.
Public evaluation datasets and better calibration tools.
Expanded accessibility testing.

Independent cryptographic review, penetration testing, and real-world evaluation are also important outstanding milestones. A 1.0.0 release is not a security certification.

Get involved

BioKyn is released under the Apache-2.0 license.

You can explore the project, report issues, suggest improvements, and contribute.

Website: https://biokyn.js.org/

GitHub: https://github.com/biokyn/biokyn

Documentation: https://github.com/biokyn/biokyn/tree/main/docs

The web needs better bot protection. It shouldn't have to sacrifice user privacy or accessibility to get it.

Welcome to BioKyn.

DEV Community