Self-hosted CAPTCHA for the modern web.
No Google. No telemetry. No visual puzzles.
Switch from reCAPTCHA in minutes.
6k stars on GitHub·Apache 2.0·Zero dependencies·20kb widget·1.1B CDN hits
Features
250x smaller than hCaptcha. No puzzles, no tracking.
Privacy-first
Zero telemetry. No third-party network. Your users' data stays between you and them.
~20kb, zero dependencies
Loads in milliseconds, not seconds.
No visual puzzles
PoW and instrumentation run silently in the background. No "click the traffic lights."
Apache 2.0
Free forever. Audit it, fork it, own it. No vendor can pull the rug.
Standalone mode
Deploy anywhere with one Docker container. Includes analytics and multi-site-key support.
Programmatic
Hide the widget entirely and solve challenges silently, ideal for APIs and forms.
API protection
Block abusive traffic while allow-listing trusted automated clients.
Fully customizable
Colors, size, position, icons, all controllable via CSS variables. No iframe lock-in.
Compared
How it compares.
Cap sits in the same detection tier as the big names, without shipping your users' data to a third party.
| Cap | reCAPTCHA | Turnstile | hCaptcha | Friendly | |
|---|---|---|---|---|---|
| Self-hosted | Yes | - | - | - | - |
| Open source | Apache 2.0 | No | No | No | No |
| No visual puzzles | Yes | Frequent | Yes | Frequent | Yes |
| No 3rd-party telemetry | Yes | Cloudflare | hCaptcha | Limited | |
| Bundle size | ~20 kb | 500 kb+ | 110 kb+ | 600 kb+ | 80 kb+ |
| Free at scale | Yes | Quota | Yes | Quota | Paid |
| Instrumentation layer | Yes | Yes | Yes | Yes | No |
Architecture
Two independent layers. Bypass one, the other still holds.
Every challenge solves proof-of-work and runs browser instrumentation at the same time. Defeating one layer doesn't defeat the other.
Layer 01 · Proof-of-work
Heavy math, in the browser.
The client solves parallel SHA-256 hashes in WASM. Tuned against GPU acceleration, real CPU time, real money to scale.
target0x0000ffff…
hashes/s2.29M
solved1.82s ✓
sha256
a7f3…b19c9d4e…3b7f2c1a…e88df06b…44a25e9c…d7108b22…cc91a7f3…b19c9d4e…3b7f2c1a…e88df06b…44a25e9c…d7108b22…cc91
Layer 02 · Instrumentation
A real browser proves itself.
A freshly-generated JS program runs DOM-dependent ops a real browser handles trivially, and a headless runtime cannot fake cheaply.
01layout.getComputedStyle…
02canvas.toDataURL14ms
03event.isTrusted1ms
04navigator.webdriver✓
Install
Drop it in. Point at your server. Verify server-side.
<!-- drop in anywhere -->
<script src="https://cdn.jsdelivr.net/npm/cap-widget"></script>
<cap-widget
data-cap-api-endpoint="https://your.server/<site-key>/">
</cap-widget>
Is it GDPR-friendly? Yes. Cap doesn't phone home, doesn't set cookies, and doesn't fingerprint users. Your server sees the verification, no one else does.
Can I migrate from reCAPTCHA / hCaptcha? Yes. Cap's siteverify API is compatible with reCAPTCHA and hCaptcha, but you'll need to swap your client-side code to use Cap's widget.
How effective is it against real bots? Cap's instrumentation combined with proof-of-work is very effective at making abuse extremely difficult to automate at scale.
What does it cost to self-host? Cap Standalone fits on a $5 VPS for most sites. There are no per-request fees, no egress to a third party, and no API quotas to hit.
Get started
Ship Cap in 15 minutes.
Drop the widget into your site, point it at a $5 VPS, and stop paying anyone to see your users' traffic.