verifyngo now has a JS-free captcha option

Aug 18, 2026

Normally, it wouldn’t matter too much if JS is enabled or not, but I am aware some people do want to use Invidious without JS, since normally it wouldn’t need it.

So, I deployed a new feature, and I am testing how well it works. Currently, the architecture of verifyngo is to introduce some amount of friction to solve a captcha (like with proof-of-work-based Cap) which some bots may not want to consistently do as that bot may have to use multiple addresses, cookie and browser setups which they then have to keep up-to-date with current protections while actively solving a difficult challenge. Which is why instead, a new addition without proof of work, but is still a form of interactive captcha is now here. This would get rid of dependancies outside the verifyngo container and tell scrapers to not keep going, as they still have to do something to get their cookies.

The verifyngo captcha screen for Invidious displaying a slider with a pattern to solve

When you visit a site using it without it being the default, you can switch to it. From there, just grab that split part of the image and slide it over to the outlined area. That’s it.

For best accessibility to non-sighted users, you should introduce other captchas, for example, Cap is WCAG 2.2 AA compliant and does not display a puzzle at all. This is why it is still the default, with normal browsing Cap has nearly zero friction upon solving it. This is just an option for those finding they needed it, or to provide a solution when a user visits and cannot solve another captcha type (like a Tor browser user, for example).

There are plans to also expand the “progressive/passive” mode with a challenge setup like GoAway and Anubis. A real browser will be given access as long as they stay within reasonable usage, using non proof-of-work systems that they both use like meta-refreshing or a correct load-order test. This change will help combat a stealthy bot while keeping legitmate users from experiencing too much friction ever. Overall, this is to stop certain lazy browsers from “staying under the radar” when they are actually bots.