Overview:
Cap is a lightweight, open-source CAPTCHA alternative that replaces visual puzzles with SHA-256 proof-of-work and JavaScript instrumentation challenges. It is designed for developers and site owners who want a fast, private, and simple bot-detection mechanism without images, tracking, or external dependencies. Cap can run on any JavaScript runtime or in a standalone Docker container, making it suitable for both web forms and API protection.
Core Features:
Proof-of-work challenges: Verifies users by requiring their browser to compute a SHA-256 hash instead of solving visual puzzles.
JavaScript instrumentation: Collects browser environment signals to distinguish human users from automated scripts.
Standalone mode: Run Cap as a Docker container with built-in analytics for server-side challenge validation.
Programmatic mode: Hide the widget and solve challenges silently in the background for frictionless user experience.
M2M (Machine-to-Machine) protection: Allows API endpoints to remain accessible to authenticated services while blocking unauthorized bots.
CSS variable customization: Adjust colors, size, position, and icons without modifying core code.
Use Cases:
Web form protection: Replacing traditional visual CAPTCHAs on login, registration, or contact forms with a faster, non-interactive challenge.
API security: Applying machine-to-machine challenges to keep endpoints accessible to trusted services while deterring automated abuse.
Privacy-conscious deployments: Running a self-hosted bot detection system that does not send user telemetry to third-party servers.
Why It Matters:
Cap offers a significantly smaller footprint—approximately 20KB with zero dependencies—compared to major alternatives like reCAPTCHA, hCaptcha, and Cloudflare Turnstile. Its proof-of-work model eliminates the need for image puzzles, and the standalone Docker mode provides complete data control. As a fully open-source project under Apache 2.0, it is a practical option for developers who want to integrate bot mitigation without third-party tracking or proprietary services.
