One of the most decorated free-VPN trap apps in the record, and still running: SuperVPN is the rare provider whose no-logs claim was falsified twice by its own infrastructure - first when ~21M user records (emails, payment data, device IMSI numbers, login times) were offered for sale from its default-credentialed databases in February 2021, then when a single unsecured database holding 360,308,817 records (133 GB) including original IPs, geolocation, refund requests and links to the websites users visited surfaced in March 2023. Before that, Google removed the Android app from Play in April 2020 over an unpatchable-in-practice MITM vulnerability (server payload contained its own decryption key; some traffic in plaintext HTTP), and the CSIRO-lineage research ranked it among the worst free Android VPNs by antivirus flags as far back as 2016. The 2026 product is unchanged in kind: 100M+ installs, ads, a VIP upsell, a 'no-log policy' claim on the store listing and an App Store privacy label asserting 'The developer does not collect any data from this app' - a statement that cannot be squared with the leaked databases. The operator has migrated its storefront identity from SuperSoftTech (Beijing-era, per TechRadar's tracing of Jinrong Zheng) to a London-registered shell-like entity (NETWORKSUPER LTD, incorporated Feb 2020, renamed from LUNASPEED LTD in 2024, Gmail support address, residential-looking street address) with no About page and no audit. It does work as a throwaway unblocker and TechRadar's leak tests found nothing leaking in 2020 - but as a privacy tool it is the inverse of what it sells, and its history is the reason 'free VPN' became a red flag in the first place.
no-logs contradicted9 red flagsfacts verified - fetched live 2026-11-03: Google Play listing (com.jrzheng.supervpnfree, full page incl. data-safety section and developer block), supervpn.best homepage + privacy.html + faq.html, Apple App Store listing (id6673905322), UK Companies House search + company profile 12451849, vpnMentor 2023 breach report, Cybernews 2021 sale-of-records article and 2022 BeanVPN context piece, Malwarebytes March 2021 article, Have I Been Pwned breach page, Tom's Guide April 2020 removal story, TechRadar May 2020 review, Cyber Daily May 2023 breach piece, WIRED 2017 CSIRO-story, the CSIRO/ICSI IMC 2016 paper PDF (fetched, text extracted), The Hacker News July 2026 MVPNalyzer study, HN Algolia comment searches and eight arctic-shift thread/IDs endpoints. Failure modes observed this session and worked around: arctic-shift keyword (body/title) search returned 422 'Timeout' and 429 on every attempt (same failure mode as the hola dossier session), so Reddit voices were gathered via link_id thread endpoints and posts/ids lookups instead; pullpush.io returned 522; reddit.com/search.json returned 403 to this datacenter IP; vpnpro.com returned 403 (its 2020 SuperVPN vulnerability research is therefore cited via Tom's Guide's summary of it); the Sophos 2020 news URL now 404s. Brand-confusion caution: at least three unrelated store apps carry 'Super VPN'-style names - this dossier covers the Android app com.jrzheng.supervpnfree ('SuperVPN - Fast VPN Proxy' / 'SuperVPN Fast VPN Client') and its official site supervpn.best; the July 2020 HK white-label cluster item 'Super VPN' (UFO VPN family) and 'VPN Proxy Speed - Super VPN' (TOPAPPS TECH PTE LTD) are different apps.
March 2023 breach: 360,308,817 records / 133 GB in a non-password-protected database (vpnMentor, Jeremiah Fowler) - emails, original IPs, geolocation, server records, secret keys, app user IDs/UUIDs, device data, refund requests, and links to websites users visited; disclosed responsibly, database closed, no reply from either developer; vpnMentor judged the exposure a contradiction of SuperVPN's own no-logs guarantee
February 2021 incident: records of ~21M users of SuperVPN/GeckoVPN/ChatVPN offered for sale on a hacker forum, exfiltrated (per the seller) from publicly exposed databases left with default credentials (Cybernews; Malwarebytes; HIBP entry SuperVPN & GeckoVPN, 20.3M addresses, added 2021-02-28); HIBP notes all three brands' data in one file suggests a shared platform
April 2020: Google removed SuperVPN (com.jrzheng.supervpnfree) from Play under the Play Security Reward Program after VPNPro's disclosure of MITM-enabling vulnerabilities; developer never responded to Google or VPNPro (Tom's Guide/TechRadar coverage)
+6 more red flags - expand before signing up
Operator shell-patterning: London entity NETWORKSUPER LTD (12451849, incorporated 2020-02-10) was called LUNASPEED LTD until 30 May 2024, sits at a residential-style street address, publishes no company information on supervpn.best, and uses a Gmail support address; earlier lineage points to developer Jinrong Zheng (LinkVPN et al.) with a Beijing address (TechRadar 2020) and the 2023 breach database to Qingdao Leyou Hudong Network Technology Co. with Chinese-language notes - vpnMentor could not confirm whether the two SuperVPN store apps share owners; Fowler also found the same customer-support emails linked to Storm VPN, Luna VPN, Radar VPN, Rocket VPN and Ghost VPN
Data-safety contradiction: App Store privacy label 'Data Not Collected' vs Play data-safety 'may collect: Personal info and Device or other IDs' vs two breach record sets containing exactly such data (emails, device IDs/IMSI, IPs)
Fake-system-UI advertising: store-page-mimicking ads in 2020 (TechRadar) and a 2026 user report of an Apple-ID-style password popup on connect with subsequent iCloud login attempts from other countries (r/vpnreviews, user claim, unverified)
2016 academic record: SuperVPN ranked #3 of the ten worst Android VPN apps by antivirus-detection ranking in the CSIRO/ICSI/UC Berkeley study of 283 Android VPN-permission apps (IMC 2016; WIRED coverage) - and TechRadar notes it was later named the third-most malware-rigged app in 2016 Australian research while growing installs via fake-review SEO
Copy-paste privacy policy referencing another company (Tutela Technologies) with self-contradictory retention claims (TechRadar 2020)
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 5 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on Super VPN yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
Super VPN is a free, ad-supported mobile proxy app for Android and iOS, marketed as a fast, unlimited, no-credit-card-needed service. It’s operated by NETWORKSUPER LTD, a UK-registered shell entity with historical ties to Chinese developers. Despite claims of being “totally free” and “SAFE, FAST and UNLIMITED,” it has a documented history of logging user data, breaches, and security flaws - making it a privacy risk, not a solution.
Logging & privacy
The provider claims a “no-log policy for full anonymity” on its Play Store listing and support pages. However, this claim is contradicted by two major incidents. In 2021, ~21 million user records - including emails, IMSI numbers, device IDs, and login times - were sold on hacker forums, pulled from exposed databases. In 2023, a 133 GB unsecured database with 360 million records surfaced, containing original IPs, geolocation, server usage, and even links to websites visited. The operator’s privacy policy admits to collecting “access logs” (IPs, OS, browser) for DDoS protection, undermining its no-logs stance. No audits, no warrant canary, and jurisdiction in the UK (with suspected Chinese backend control) add further risk.
Pricing & the renewal trap
The free tier requires no account and promises unlimited use, funded by ads. A VIP in-app purchase offers ad-free browsing and “faster speeds,” but current pricing isn’t listed on the website or stores. Past data shows VIP costing $5/month or $60 for 21 months ($2.86/month). A 2025 iOS promotion advertised a $69.99 lifetime plan, but users reported it defaulted to full price. The derived_pricing shows no verifiable renewal data, so long-term costs are unknown. There is no refund window listed, and payment is handled via app stores (no anonymous crypto options).
Features & performance
The app supports Android, iOS, and iPad, with split tunneling (“Smart Proxy”) on Android. It lacks a kill switch, multihop, dedicated IP, or Tor support. Protocols are unspecified - no mention of WireGuard, OpenVPN, or IKEv2 - only vague “high encryption.” Servers and countries are unlisted, though the free tier historically offered 8 locations. P2P is not supported; streaming works for some services like US Netflix (per 2020 testing), but not BBC iPlayer or Disney+. No independent performance tests are available, and the app has been flagged for malware and tracking.
Ownership & track record
The legal entity is NETWORKSUPER LTD, a UK micro-company incorporated in 2020, previously named LUNASPEED LTD. It uses a Gmail address for support and a residential London address. Historical links point to SuperSoftTech (Beijing) and Qingdao Leyou Hudong in China. The app has been flagged since 2016: ranked third-worst in a CSIRO/ICSI study for antivirus detections, removed from Google Play in 2020 for MITM vulnerabilities, and linked to fake reviews and permission overreach. Two massive data exposures (2021, 2023) confirm logging despite no-logs claims. Reddit users report fake Apple ID popups and iCloud login attempts post-use, suggesting credential harvesting.
Censorship resistance
Super VPN offers no documented obfuscation methods like obfs4 or domain fronting. It is not suitable for use in heavily censored countries like China, Iran, or Russia. Its infrastructure has shown vulnerabilities to MITM attacks, and its Chinese development lineage includes ToS language aligned with state censorship policies. Without obfuscation or proven stealth, connections are likely detectable and blockable on restrictive networks.
Verdict
Avoid Super VPN. Its no-logs claim has been falsified twice by its own leaked databases, and its history includes malware, MITM flaws, and credential harvesting. It’s not a privacy tool - it’s a data harvesting operation disguised as one. The 100M+ installs are a warning, not a recommendation. This provider does not run an affiliate program, but its survival is fueled by app store algorithms and user complacency. For real privacy, use audited, independent providers.
++ What holds up
Genuinely free as advertised: no registration, one-tap connect, 'no bandwidth or time limited' (operator site + Play listing) - and 100M+ installs show it works often enough to keep people
In TechRadar's May 2020 hands-on testing, IPLeak/Doileak leak tests 'couldn't find any giveaway leaks or clues to our real identity', and US Netflix streamed successfully from the US location
Smart Proxy per-app split tunneling is real and documented in the operator's own FAQ (choose which apps use the VPN)
VIP tier is a straightforward in-app purchase ('Cancel anytime') rather than a subscription trap, and the App Store/Play listings disclose ad-funding plainly
-- What to watch
No-logs claim contradicted twice: 360,308,817 records (emails, original IPs, geolocation, refund requests, links to visited websites, secret keys) exposed in a non-password-protected database in March 2023; ~21M user records sold on a hacking forum in February 2021 (HIBP: 20.3M addresses, incl. login date/time, device serials, IMSI numbers)
Removed from Google Play in April 2020 over a critical MITM vulnerability: VPNPro found the app's server payload 'contained the key needed to decrypt the information', some data sent via unsecured HTTP, and the developer (SuperSoftTech) was unreachable when Google tried to get it patched (Tom's Guide, Apr 2020)
2020 privacy policy was 'cobbled together' from a legitimate company's policy (Tutela Technologies name and links left in), claimed 'We do not monitor your traffic' and then stated it keeps 'all information on highly secured servers based in United Kingdom and USA' (TechRadar review: 'Worthless privacy policy')
Operator opacity: no About page on supervpn.best ('NetwokSuper LTD' with a typo in its own copyright line), support via Gmail (goanalyticsapp@gmail.com), UK entity renamed from LUNASPEED LTD in 2024, address is a residential-style London street address
Sensitive permissions historically documented (read phone status and identity, read and modify storage - TechRadar 2020; vpnMentor 2023: permissions 'allow the VPN to access the device's files, images, and other device information') plus Google Analytics/Crashlytics trackers found in the app
Store privacy labels conflict with reality: App Store listing claims 'Data Not Collected - The developer does not collect any data from this app' (fetched 2026-11-03) while Play declares collection of 'Personal info and Device or other IDs' and both contradict the breached record sets
Aggressive ad monetization: TechRadar 2020 reported full-screen ads that mimic a Google Play store page ('very easy to click Install'); a 2026 r/vpnreviews user reports an Apple-ID-look phishing popup appearing on connect (unverified user report, but the store's own ads were documented mimicking system UI as early as 2020)
Free tier is location-limited (8 locations in 2020 testing), speed-capped in practice (20-30 Mbps), and sessions auto-disconnect after 60 minutes
No protocol transparency, no audit, no kill switch, no streaming reliability (BBC iPlayer, Prime Video, Disney+ all failed in 2020 testing)
Pricing reality check
Intro price
$5 /mo
Notes
No prices are published on the operator website or the store listings themselves (checked 2026-11-03) - pricing lives inside the app as a 'VIP' in-app purchase ('Upgrade to VIP for: Ad-free experience, Faster VPN speeds, Premium servers, Better performance. Cancel anytime', Play listing). The best documented figures are TechRadar's May 2020 hands-on test: 'Prices starts at $5 for a single month, falling to $2.86 on the annual plan (which is actually $60 to cover 21 months, as you get nine for free)' - a single-Android-device subscription. On iOS, a 2025 Reddit deal thread documents a $69.99 lifetime in-app price (multiple users report seeing $69.99/$79.99 EUR lifetime instead of the advertised free deal).
Check the renewal price above before any multi-year plan - true-cost calculator.
Is Super VPN legit?
Legal domicile: United Kingdom entity (NETWORKSUPER LTD) listed on both stores, with documented historical Chinese development lineage (Beijing address via TechRadar; Qingdao Leyou Hudong per vpnMentor); whether the UK entity is the true controlling operator is not established by any public record - legal entity NETWORKSUPER LTD (Companies House 12451849, London, incorporated 2020-02-10, renamed from LUNASPEED LTD May 2024) is primary-sourced; historical developer lineage points to China (Jinrong Zheng/Beijing per TechRadar 2020; Qingdao Leyou Hudong attributed for the 2023 breach database, unconfirmed link). Logging claim: Play store listing (fetched 2026-11-03): 'No-log policy for full anonymity'. The 2023 vpnMentor report quotes the SuperVPN (Qingdao app) support page: 'SuperVPN keeps no logs which enable interference with your IP address, the moment or content of your data traffic. We make express reference to the fact that we do not record in logs communication contents or data regarding the accessed websites or the IP addresses'. - evidence class: CLAIM CONTRADICTED. Our incident log carries 2 documented incident(s) for this operator - see the record below. Facts verified - fetched live 2026-11-03: Google Play listing (com.jrzheng.supervpnfree, full page incl. data-safety section and developer block), supervpn.best homepage + privacy.html + faq.html, Apple App Store listing (id6673905322), UK Companies House search + company profile 12451849, vpnMentor 2023 breach report, Cybernews 2021 sale-of-records article and 2022 BeanVPN context piece, Malwarebytes March 2021 article, Have I Been Pwned breach page, Tom's Guide April 2020 removal story, TechRadar May 2020 review, Cyber Daily May 2023 breach piece, WIRED 2017 CSIRO-story, the CSIRO/ICSI IMC 2016 paper PDF (fetched, text extracted), The Hacker News July 2026 MVPNalyzer study, HN Algolia comment searches and eight arctic-shift thread/IDs endpoints. Failure modes observed this session and worked around: arctic-shift keyword (body/title) search returned 422 'Timeout' and 429 on every attempt (same failure mode as the hola dossier session), so Reddit voices were gathered via link_id thread endpoints and posts/ids lookups instead; pullpush.io returned 522; reddit.com/search.json returned 403 to this datacenter IP; vpnpro.com returned 403 (its 2020 SuperVPN vulnerability research is therefore cited via Tom's Guide's summary of it); the Sophos 2020 news URL now 404s. Brand-confusion caution: at least three unrelated store apps carry 'Super VPN'-style names - this dossier covers the Android app com.jrzheng.supervpnfree ('SuperVPN - Fast VPN Proxy' / 'SuperVPN Fast VPN Client') and its official site supervpn.best; the July 2020 HK white-label cluster item 'Super VPN' (UFO VPN family) and 'VPN Proxy Speed - Super VPN' (TOPAPPS TECH PTE LTD) are different apps. (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
Incident record (2)
2021GeckoVPN / ChatVPN / SuperVPN user data sold on hacking forumsIn late February 2021 a seller offered a combined dataset of ~10M users (seller claimed 360M records) from SuperVPN, GeckoVPN and ChatVPN: e
2020SuperVPN leaks 10 million user recordsThe Android free VPN SuperVPN left user records - emails, passwords in weak form, payment data, device IDs - exposed and circulating from Fe
Super VPN FAQ
Is Super VPN legit?
Based on our checks as of 2026-11-03: Super VPN scores 1.9/10 in our weighted review. We logged 9 red flags (listed above). Its logging claim has been contradicted in a documented case - treat "no logs" marketing as marketing. User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get with the free tier?
Unlimited bandwidth and access to 8 server locations (US, UK, Canada, etc.), but with ads, session limits after 20 days (60-minute disconnects), and no account needed - though your device and IP are logged and have been leaked twice.
What is the renewal price and total 3-year cost?
The **`derived_pricing`** shows no verifiable renewal data, so the renewal price and 3-year total are unknown. Past VIP plans cost $5/month or $60 for 21 months; iOS lifetime offers of $69.99 have failed to deliver as advertised.
What evidence is there for the no-logs claim?
None - instead, there is **contradicted** evidence: two major breaches (2021, 2023) exposed original IPs, emails, device IDs, and browsing activity, proving extensive logging despite public claims.
Does this work in censored countries like China or Iran?
No. There is no obfuscation, and the app’s infrastructure has Chinese ties with state-aligned ToS language. It’s not designed for censorship resistance and will likely be blocked.
Can I pay anonymously?
No direct payment options are offered. VIP upgrades are in-app purchases via Google Play or Apple App Store, which require accounts. No cryptocurrency or anonymous methods are supported.
What happens if the service shuts down?
Given the operator’s history of data exposure and lack of transparency, a shutdown could lead to unsecured data dumps. There’s no public infrastructure or open-source code to ensure continuity or accountability.
What’s the honest free or cheap alternative?
Use ProtonVPN’s free tier (audited, no ads, based in Switzerland) or Mullvad (flat-rate, anonymous accounts, proven no-logs). Avoid “free” apps that monetize your data - Super VPN is the textbook example of why they’re dangerous.
The meta-review: what the internet says about Super VPN
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates Super VPN. Every claim links to its source so you can verify it yourself.
What other reviewers say (1)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03: hands-on review, verdict 'raises so many red flags that it is impossible to recommend for even the simplest of tasks'. Documents: free tier unlimited bandwidth but 8 locations (FR/DE/JP/NL/SG/UK/CA/US), VIP adds Hong Kong; 20 days unrestricted then 60-minute auto-disconnect sessions; pricing $5/month, $60 for 21 months ($2.86/mo) on one Android device; developer SuperSoftTech with no website, address traced to Jinrong Zheng (LinkVPN et al.), Gmail-only contact and a Beijing address; privacy policy copied from Tutela Technologies ('We do not monitor your traffic' next to 'we keep all information on highly secured servers based in United Kingdom and USA'); permissions incl. read phone status/identity and read/modify storage; Google Analytics + Crashlytics; ads mimicking a Play Store page; Smart Proxy split tunneling; 20-30 Mbps speeds; US Netflix worked, BBC iPlayer/Prime/Disney+ failed; IPLeak/Doileak found no leaks. Affiliate-funded site (disclosure in page).
What users say (2)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03 (HTTP 200; sibling pulls for 1nryk3q, 6qsac3, fy19et, fx4r4r, 93drtm, 1mglup0, 1usb8cg and two posts/ids lookups all HTTP 200): 2026 thread 'do NOT use super vpn !!!' (Apple-ID-look popup, iCloud login attempts from random countries, commenters citing the Chinese-owned cluster and recommending Mullvad/Proton/Windscribe); 2025 r/antivirus thread ('riskware / not-a-virus... known since 2020'); 2017 'SuperVPN is a scam' ($30 undelivered plan, no refund); 2020 removal threads; 2018 clone-cluster PSA; 2025 iOS lifetime-deal thread.
Fetched 2026-11-03 (HTTP 200; second query variant 'super vpn' also 200): only two on-topic comments - a 2017 listing of SuperVPN from That One Privacy Site's spreadsheet in an Ask HN thread, and 2020 comments on the UFO VPN white-label leak threads (naming the separate HK 'Super VPN' brand); no HN discussion of SuperVPN Fast VPN Client itself - the brand has effectively no presence in technically-minded communities, in contrast to its 100M installs on Play.
Who is behind Super VPN?
VPN ownership is often deliberately layered through shell companies. This is what we could verify - with sources. Confidence: unclear (checked 2026-09-29).
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: The no-logs claim of Super VPN has been contradicted by two major incidents. It is not safe for privacy, despite working as a basic unblocker. The app remains active with 100M+ installs but has a documented history of logging and exposure.
The logging truth: The provider claims a no-logs policy, but evidence contradicts this. A 2023 unsecured database exposed 360 million records including original IPs, email addresses, geolocation, and browsing activity links. A 2021 incident leaked 20.3 million records with IMSI numbers and login histories. Jurisdiction is nominally the UK via NETWORKSUPER LTD, but historical development ties to China raise additional concerns.
Pricing reality: The app is free with ads and pushes a VIP in-app purchase for "faster speeds" and "premium servers." No pricing is listed on the website or stores - costs appear only inside the app. Past reports cite $5/month or $60 for 21 months; a 2025 iOS "lifetime free" promotion instead charged $69.99, suggesting deceptive upselling.
What reviewers say vs what users say: Affiliate reviewers like TechRadar (2020) call the privacy policy "worthless" and note copied content and red flags, yet found no leaks in testing. Independent users on Reddit report fake Apple ID popups, iCloud breaches, malware warnings, and failed "free" promotions. The conflict is stark: commercial reviews test functionality, while users report credential harvesting and distrust.
Who runs it: The legal entity is NETWORKSUPER LTD, a UK-registered shell company with a residential address and Gmail support. It was incorporated in 2020 and renamed from LUNASPEED LTD in 2024. The original developer, SuperSoftTech, is linked to Beijing and Qingdao-based firms, but ownership continuity is unconfirmed. No transparency exists on actual control.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 7[B] B: 11[C] C: 2[D] D: 0(D stays empty until our own test phase)
A heavyweight free-mobile VPN from a Singapore entity with real strengths on paper - no account required, an unusually deep protocol lineup, a self-published…
auditcrypto accepted
intro $2.99 /mo
Singapore - LIGHTNINGLINK NETWORKS PTE. LTD. (own privacy policy and both app-store listings; Play developer address 8 Marina View #43-01 Asia Square Tower 1, Singapore 018960). Note: 2026 reviews still describe the operator as 'Free Connected Ltd., a private company based in Hong Kong' (Security.org) and 'Based in Hong Kong' (Cloudwards), while the operator's own live documents say Singapore - the entity migration is documented but the current corporate history is not publishedfree vpn 9 d ago
The most trustworthy free VPN on structural grounds: an anarchist Seattle collective that has run since 1999, funds itself by donations, asks no account…
VPN Gate is a legitimate, transparently-run academic experiment that is genuinely free forever and genuinely useful for one thing: getting past government…
auditopen source
intro $0 /mo
Japan - web site hosted at the University of Tsukuba campus (Tennodai 1-1-1, Tsukuba, Ibaraki 305-8573), administrator Daiyuu Nobori, Ph.D., Associate Professor, University of Tsukuba; the volunteer relays themselves are distributed worldwide and 'are not placed in the campus'; aggregated log servers are owned and managed by SoftEther Corporation, the joint research partner (about_us.aspx and about_abuse.aspx fetched 2026-11-03)free vpn 10 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.