
ALTCHA
Self-hosted, GDPR-compliant CAPTCHA alternative that stops spam with privacy-friendly proof-of-work challenges.
ALTCHA is a self-hosted, privacy-first CAPTCHA alternative that protects websites, APIs, and online services from spam and abuse using a proof-of-work (PoW) mechanism instead of visual puzzles. Instead of asking users to click traffic lights, the browser solves a computational challenge in the background, so most real users never see a challenge at all.
Unlike Google reCAPTCHA and hCaptcha, which run as third-party services and collect behavioral signals from visitors, ALTCHA is cookie-free and collects no data, making it GDPR, HIPAA, CCPA, and LGPD compliant out of the box. It is also engineered to WCAG 2.2 AA accessibility standards and complies with the European Accessibility Act, with audio fallbacks for users who need them. The widget is distributed as a lightweight Web Component (about 34 kB gzipped, roughly 90% smaller than reCAPTCHA).
The latest version hardens the PoW mechanism against specialized hardware by supporting memory-bound Argon2 and Scrypt algorithms, which neutralize ASIC and GPU acceleration used by bot farms. Server-side verification libraries are available for TypeScript, PHP, Python, Go, Ruby, Java, Rust, Dart, Elixir, and C++, plus starter templates for React, Vue, Svelte, Solid, Lit, and Angular. Being fully self-hosted, you keep complete sovereignty over your infrastructure with no reliance on third-party API availability or usage quotas.








