Open Source Cloudflare Turnstile Alternatives

Cap replaces the visual captcha with a proof-of-work challenge the browser solves by itself. There are no images to squint at, no grid of traffic lights, and no user interaction at all if you choose to hide the widget and let challenges resolve in the background.

The widget weighs roughly twenty kilobytes with zero dependencies, which the project puts at 250 times smaller than hCaptcha. It is offered as a replacement for reCAPTCHA, hCaptcha and Cloudflare Turnstile, and the default way to run it is a standalone Docker container.

The design follows from treating a captcha as something that should cost the visitor nothing.

• Proof-of-work: challenges solved by the machine rather than puzzles solved by the person.
• Instrumentation challenges: a second signal used alongside the computational work.
• Privacy-first: no telemetry is sent back to the project's servers.
• Customizable: colors, size, position and icons all controlled through CSS variables.
• Standalone mode: the Docker container runs anywhere and brings analytics with it.

Deployment is a container you host, with a one click Railway template for anyone who would rather not. Cap is free and open source under the Apache 2.0 license, and the documentation includes a live demo worth trying before wiring it into a signup form.

ALTCHA protects websites, APIs and online services from spam and abuse without asking anyone to identify a traffic light. Verification runs as background proof-of-work, so the visitor meets a checkbox rather than a puzzle, and no cookies, fingerprinting or data collection are involved.

The widget ships as a Web Component, installed from npm or loaded with a script tag, and it needs a browser with Web Crypto support, which covers Chrome 67, Edge 79, Firefox 63 and Safari 11 upward. Simple cases are configured with HTML attributes, while a global object handles defaults, custom algorithms and added translations.

Version 3 concentrates on the cost of an attack and the shape of the widget.

• Memory-bound algorithms: Argon2 and Scrypt raise the price of automation for GPUs, ASICs and bot farms.
• Accessible fallbacks: a code-from-image challenge with audio support for visually impaired users.
• Display modes: standard, bar, floating, overlay and invisible layouts, with new built-in themes.
• Small payload: roughly 34 kB gzipped, about ninety percent smaller than reCAPTCHA.
• Server libraries: implementations for TypeScript, Go, Python, PHP, Java, Ruby, Rust, Elixir, Dart and C++.
• Starter templates: React, Vue, Svelte, Solid, Lit and Angular examples to build from.

Being fully self-hosted, it leaves no third-party API to depend on. The project states compliance with GDPR, HIPAA, CCPA, PIPEDA, LGPD, DPDPA and PIPL, plus WCAG 2.2 AA and the European Accessibility Act, and a strict Content Security Policy is served by the external distribution instead of the default single-file bundle.

Image CAPTCHAs cost every honest visitor a few seconds of attention and cost an attacker almost nothing. mCaptcha inverts that trade, shifting the cost onto the visitor's computer instead of the visitor. It uses SHA256 proof of work to make hammering a site more expensive for the sender than answering is for the server.

A user clicks once, the browser computes a proof, and mCaptcha validates it. A valid proof returns a token the user submits with the request, and the target site verifies that token before doing any work of its own. Difficulty is variable, so a well-behaved visitor sees no delay under moderate load and up to about two seconds when a site is under attack. Apart from that click, the exchange is automatic.

The design follows from putting the cost on the client rather than on identifying anyone.

• No tracking: the CAPTCHA routes are cookie free.
• IP address independent: visitors behind NAT are handled without being punished for a shared address.
• Replay resistant: proof of work configurations live for 30 seconds and are accepted only once.
• Variable difficulty: the work demanded rises with load rather than being fixed.
• Self-hostable: a clone and a docker-compose command bring the service up on port 7000.

Two demo servers are public, one running on a Raspberry Pi, which gives a fair sense of the server-side cost. The project calls itself active development with no stable release yet, so hosted demos may trail master. Development during 2023 was funded through the NGI Zero Entrust Fund via NLnet.

Replacing reCAPTCHA, hCaptcha or Cloudflare Turnstile usually means swapping one data collector for another. Procaptcha is described by its authors as a drop-in replacement for all three that protects user privacy and collects zero data, which is the awkward part of every other option on that list.

It works on a risk model rather than a challenge for everyone. Requests are scored to separate a person from an AI agent or a bot, and a verification step only appears when that score crosses a threshold, so ordinary traffic passes without a puzzle.

The pieces around the widget are what make it deployable.

• Front end packages: components for React, Vue and Angular, plus plugins for the common WordPress form builders and other CMS platforms.
• Edge deployment: the check can run on Cloudflare Workers and AWS Lambda at the edge.
• Signals: behavioral analysis, JavaScript checks, proof of work, device context and IP reputation feed the score.
• Compliance: the project claims GDPR, CCPA, LGPD and PIPEDA compliance with no cookies or cross-site tracking, and WCAG 2.1 accessibility.
• Self-hosting: the software can be run as a self-hosted bot protection setup, with the client-side detection library the one closed piece.

The repository is a monorepo of the open source packages behind the product, with a separate document covering the development environment. A sitekey from the hosted service is needed to use the library, and the maintainers offer help to anyone taking the self-hosted route.

Private Captcha replaces the frustrating image puzzle with a proof of work challenge the visitor's browser solves on its own. It is an independent, privacy first service made in the EU, positioned as an alternative to reCAPTCHA, hCaptcha and Cloudflare Turnstile, and it processes no personal data and no behavioral tracking.

The backend is Go, with Postgres holding business data such as accounts and properties, and ClickHouse holding operational data such as difficulty scaling and statistics. The client widget is JavaScript with WASM workers where the browser allows them, and the portal interface uses Tailwind.

The project states its goals plainly, and the feature list follows from them.

• Adaptive difficulty: challenge difficulty scales rather than staying fixed, with configuration options around it.
• Light widget: the widget is customizable and has an invisible variant for forms that should show nothing.
• Efficient backend: the server is optimized for low resource requirements and low latency under load.
• Usage statistics: the backend reports usage without collecting personal information from visitors.
• Stable integrations: the project commits to a backward compatible API over time.

A development instance starts with one make target and Docker, while production self-hosting lives in a separate repository with documentation on the main docs site, and an OpenAPI spec ships in the repo. The license is PolyForm Noncommercial, which covers self-hosting the community edition for noncommercial use, with commercial licenses sold for the enterprise edition.

This repository holds the browser half of Friendly Captcha, a service that protects websites and applications from automated abuse. It is the code that runs on your site and inserts the captcha widget, published to npm and released under the Mozilla Public License 2.0.

Integration takes three steps: create a sitekey, install the widget, and verify the returned response on your server. In code that means constructing the SDK once, then calling createWidget with the element to mount under and the sitekey, reusing the same SDK instance for every widget on a page. Both ES module imports and CommonJS require are supported.

The documented surface is small and centered on the widget lifecycle.

• Configuration: options are supplied when a widget is created.
• Events: your JavaScript can listen for widget changes, commonly to enable or disable a form's submit button.
• Lifecycle: the widget moves through a fixed set of states rather than an open-ended one.
• Reference: API documentation is generated from the codebase itself and published to the developer hub.
• Tests: unit tests cover the basics and a separate sdktest tool runs end-to-end checks.

This SDK targets version 2 only, since version 1 sites use the older friendly-challenge library. Contributions are welcome but need a signed contributor license agreement first, and the service behind the widget needs an account, so what is open here is the client integration rather than the verification backend.