Self-hosted CAPTCHAfor the modern web.
Self-hosted CAPTCHA
for the modern web.No Google. No telemetry. No visual puzzles. Switch from reCAPTCHA in minutes.Drop-in reCAPTCHA replacement. Privacy-first. No tracking. No puzzles.
Read the docs →Read the docsSelf-host Cap →Self-host CapGet started in 5 minutes →Get started in 5 minutesWatch it in action ↗Watch it in actionView live demo ↗View live demoTry it yourself ↗Try it yourselfTry the demo ↗Try the demo
6k stars on GitHub·Apache 2.0·Zero dependencies·20kb widget·1.1B CDN hits
Features
250x smaller than hCaptcha.
No puzzles, no tracking.Privacy-first
Zero telemetry. No third-party network. Your users' data stays between you and them.
\~20kb, zero dependencies
Loads in milliseconds, not seconds.
No visual puzzles
PoW and instrumentation run silently in the background. No "click the traffic lights."
Apache 2.0
Free forever. Audit it, fork it, own it. No vendor can pull the rug.
Standalone mode
Deploy anywhere with one Docker container. Includes analytics and multi-site-key support.
No user interaction
Hide the widget entirely and solve challenges silently, ideal for APIs and forms. Ready for headless browser detection.
GDPR & WCAG 2.2 compliant
Meets strict privacy and accessibility standards.
Fully customizable
Colors, size, position, icons, all controllable via CSS variables. No iframe lock-in.
Compared
How it compares.
Cap sits in the same detection tier as the big names, without shipping your users' data to a third party.
| | Cap | reCAPTCHA | Turnstile | hCaptcha | Friendly | | ---------------------- | ---------- | --------- | ---------- | -------- | -------- | | Self-hosted | Yes | \- | \- | \- | \- | | Open source | Apache 2.0 | No | No | No | No | | No visual puzzles | Yes | Frequent | Yes | Frequent | Yes | | No 3rd-party telemetry | Yes | Google | Cloudflare | hCaptcha | Limited | | Bundle size | \~20 kb | 500 kb+ | 110 kb+ | 600 kb+ | 80 kb+ | | Free at scale | Yes | Quota | Yes | Quota | Paid | | Instrumentation layer | Yes | Yes | Yes | Yes | No |
Architecture
Two independent layers.
Bypass one, the other still holds.Every challenge solves proof-of-work and runs browser instrumentation at the same time. Defeating one layer doesn't defeat the other.
Layer 01 · Proof-of-work
Heavy math, in the browser.
The client solves parallel SHA-256 hashes and time-lock challenges in WASM. Tuned against GPU acceleration, real CPU time, real money to scale.
target0x00010000…
hashes/s2.38M
solved1.82s ✓
`sha256`
a7f3…b19c9d4e…3b7f2c1a…e88df06b…44a25e9c…d7108b22…cc91a7f3…b19c9d4e…3b7f2c1a…e88df06b…44a25e9c…d7108b22…cc91
Layer 02 · Instrumentation
A real browser proves itself.
A freshly-generated JS program runs DOM-dependent ops a real browser handles trivially, and a headless runtime cannot fake cheaply.
01layout.getComputedStyle4ms
02canvas.toDataURL7ms
03event.isTrusted1ms
04navigator.webdriver✓
`dom`
Install
Drop it in. Point at your server.
Verify server-side.HTMLReactDockerVerifyCopy
<!-- drop in anywhere --> <script src="https://cdn.jsdelivr.net/npm/cap-widget"></script>
<cap-widget data-cap-api-endpoint="https://your.server/<site-key>/"> </cap-widget>
CDN hits · 12mo01234567890,012345678900123456789001234567890,012345678900123456789001234567890,012345678900123456789001234567890
Nov 13May 14
size20_kb_vs 600 kb+ hCaptcha
trackers0vs reCAPTCHA
cost$0_/mo_vs $1k+ hCaptcha
setup15_min_docker container
Is it GDPR-friendly? Yes. Cap doesn't phone home, doesn't set cookies, and doesn't fingerprint users. Your server sees the verification, no one else does.
Can I migrate from reCAPTCHA / hCaptcha? Yes. Cap's siteverify API is compatible with reCAPTCHA and hCaptcha, but you'll need to swap your client-side code to use Cap's widget.
How effective is it against real bots? Cap's instrumentation combined with proof-of-work is very effective at making abuse extremely difficult to automate at scale.
What does it cost to self-host? Cap Standalone fits on a $5 VPS for most sites. There are no per-request fees, no egress to a third party, and no API quotas to hit.
Get started
Ship Cap in 15 minutes.
Drop the widget into your site, point it at a $5 VPS, and stop paying anyone to see your users' traffic.