ALTCHA
Self-hosted, GDPR-compliant CAPTCHA alternative that stops spam with privacy-friendly proof-of-work challenges.
Open source alternative to:
ALTCHA is a self-hosted, privacy-first CAPTCHA alternative that protects websites, APIs, and online services from spam and abuse using a proof-of-work (PoW) mechanism instead of visual puzzles. Instead of asking users to click traffic lights, the browser solves a computational challenge in the background, so most real users never see a challenge at all.
Unlike Google reCAPTCHA and hCaptcha, which run as third-party services and collect behavioral signals from visitors, ALTCHA is cookie-free and collects no data, making it GDPR, HIPAA, CCPA, and LGPD compliant out of the box. It is also engineered to WCAG 2.2 AA accessibility standards and complies with the European Accessibility Act, with audio fallbacks for users who need them. The widget is distributed as a lightweight Web Component (about 34 kB gzipped, roughly 90% smaller than reCAPTCHA).
The latest version hardens the PoW mechanism against specialized hardware by supporting memory-bound Argon2 and Scrypt algorithms, which neutralize ASIC and GPU acceleration used by bot farms. Server-side verification libraries are available for TypeScript, PHP, Python, Go, Ruby, Java, Rust, Dart, Elixir, and C++, plus starter templates for React, Vue, Svelte, Solid, Lit, and Angular. Being fully self-hosted, you keep complete sovereignty over your infrastructure with no reliance on third-party API availability or usage quotas.
Frequently Asked Questions
Which platforms and browsers does ALTCHA support?
ALTCHA ships as a Web Component that runs in any modern browser with Web Crypto API support, including Chrome, Edge, Firefox, and Safari on desktop and mobile. Starter templates are available for React, Vue, Svelte, Solid, Lit, and Angular, and server verification libraries exist for TypeScript, PHP, Python, Go, Ruby, Java, Rust, Dart, Elixir, and C++.
Does ALTCHA work with strict Content Security Policies?
Yes. The default bundle inlines styles and workers in a single file, but for strict CSP setups you can serve the separate scripts from the /dist/external directory of the package, which avoids inline scripts entirely.
How accessible is ALTCHA compared to traditional CAPTCHAs?
ALTCHA is engineered to meet WCAG 2.2 AA-level standards and complies with the European Accessibility Act. Since most real users solve the proof-of-work challenge invisibly in the background, there are no image puzzles to struggle with, and accessible code challenges include built-in audio support for visually impaired users.
Can I translate the ALTCHA widget into my own language?
Yes. The widget ships with bundled translations (the full bundle with all translations is about 52 kB gzipped), and the global $altcha object lets you register custom translations programmatically for any language.
How does ALTCHA stop bots if there are no puzzles to solve?
It issues a computational proof-of-work challenge that the browser must solve before a form can be submitted. Version 3 supports memory-bound Argon2 and Scrypt algorithms, which are deliberately expensive for ASICs, GPUs, and bot farm hardware, so automated abuse becomes costly while ordinary users notice nothing.