ALTCHA

ALTCHA protects websites, APIs and online services from spam and abuse without asking anyone to identify a traffic light. Verification runs as background proof-of-work, so the visitor meets a checkbox rather than a puzzle, and no cookies, fingerprinting or data collection are involved.

The widget ships as a Web Component, installed from npm or loaded with a script tag, and it needs a browser with Web Crypto support, which covers Chrome 67, Edge 79, Firefox 63 and Safari 11 upward. Simple cases are configured with HTML attributes, while a global object handles defaults, custom algorithms and added translations.

Version 3 concentrates on the cost of an attack and the shape of the widget.

• Memory-bound algorithms: Argon2 and Scrypt raise the price of automation for GPUs, ASICs and bot farms.
• Accessible fallbacks: a code-from-image challenge with audio support for visually impaired users.
• Display modes: standard, bar, floating, overlay and invisible layouts, with new built-in themes.
• Small payload: roughly 34 kB gzipped, about ninety percent smaller than reCAPTCHA.
• Server libraries: implementations for TypeScript, Go, Python, PHP, Java, Ruby, Rust, Elixir, Dart and C++.
• Starter templates: React, Vue, Svelte, Solid, Lit and Angular examples to build from.

Being fully self-hosted, it leaves no third-party API to depend on. The project states compliance with GDPR, HIPAA, CCPA, PIPEDA, LGPD, DPDPA and PIPL, plus WCAG 2.2 AA and the European Accessibility Act, and a strict Content Security Policy is served by the external distribution instead of the default single-file bundle.