Logins
Brute force protection
Brute force protection on a form means each guess costs more than a single HTTP request.
The puzzle is that extra cost.
Together
Use the puzzle beside your existing controls.
What is a brute force attack? explains the idea without a method.
Cost per guess
The browser, or the script pretending to be one, must finish proof of work before the attempt counts.
Lockout still helps
After repeated failures, your application can slow or stop that account.
The puzzle does not remove that control.
Rate limits on puzzles
Addresses that ask for many puzzles get harder work.
That limit uses a salted hash of the address.
Add the widget to login
Verify the token on the server before you check the password.