Overview:
mCaptcha is an open-source, privacy-respecting CAPTCHA system that uses SHA256-based proof-of-work (PoW) to rate-limit users. Instead of presenting image-based challenges, it requires the user's browser to perform computational work before submitting a request, resulting in a silent, click-based user experience. It is designed for website owners who want bot protection without tracking users or relying on cookies, and is currently in active development.
Core Features:
SHA256 proof-of-work: Uses computational challenges to rate-limit website access requests.
Silent client-side widget: Users initiate CAPTCHA verification with a single click, no image puzzles required.
Cookie-free routes: The CAPTCHA challenge endpoints do not set cookies on the user's browser.
Replay attack resistance: Proof-of-work configurations have short lifetimes (30 seconds) and can be used only once.
Variable PoW difficulty: The computational difficulty adjusts automatically (from near-zero delay under moderate load to up to 2 seconds under attack).
Use Cases:
Web developers who want to add bot protection to forms or endpoints without degrading user experience with image challenges.
Self-hosters running the system via Docker Compose for their own websites.
Privacy-sensitive projects that need CAPTCHA mechanisms that do not track users via cookies or IP addresses (IP-independent verification).
Why It Matters:
mCaptcha reimagines CAPTCHA as a computational proof-of-work system rather than an interactive visual test. It is entirely open-source, cookie-free by design, and supports self-hosting via Docker Compose. Its architecture eliminates tracking and IP dependency, offering an alternative to traditional CAPTCHA services while keeping the user experience frictionless. The project is currently under active development with hosted demos available for testing.
