HMAC-signed challenges solved in the browser's Web Workers
ALTCHA is a CAPTCHA you run yourself, split into two MIT-licensed parts: an <altcha-widget> Web Component and a set of server libraries. Your server signs a challenge with HMAC. The browser then searches, in Web Workers, for the counter whose derived key starts with the required prefix, and your server checks the solution before accepting the form. The open-source version talks to no third-party service.
Cap and mCaptcha also make the browser do the proof-of-work. mCaptcha, though, is a separate AGPL-3.0 server, whereas ALTCHA drops into the backend you already have as a library.
The comparison of self-hosted CAPTCHAs weighs what ALTCHA's proof-of-work stops, and what it lets through, against the other tools.
34 kB on the page, server libraries in 11 languages
- 34 kB gzipped, 52 kB with every translation. The README puts reCAPTCHA above 300 kB.
- Optional Argon2id and scrypt: memory-hard algorithms picked to blunt GPUs and ASICs, loaded as separate workers on top of the bundled PBKDF2 and SHA.
- Accessibility claimed at WCAG 2.2 AA: keyboard navigation, screen-reader labels, more than 50 languages.
- Server libraries in 11 languages, all MIT, including PHP, Go, Python, Java, Rust and .NET. On the JavaScript side,
altcha-libships plugins for Express, Fastify, Hono, NestJS, Next.js, Nuxt and SvelteKit. - Email addresses hidden from scrapers: a plugin encrypts a value that the widget decrypts only once the challenge is solved.
Replay protection on your side, risk-based challenges on paid plans
Verification and replay protection are your server's job. The server has to issue a fresh, single-use challenge for each interaction and verify the proof that comes back. The altcha-lib plugins provide CappedMap, a size-capped in-memory store, for that purpose. In a distributed setup the docs call for a central store such as Redis with an atomic setIfAbsent; without it, two simultaneous submissions of the same challenge can both pass.
The open-source version gives every visitor the same check. The project's comparison page keeps risk-based challenges, real-time threat intelligence and the dashboard for paying customers. Sentinel, the paid self-hosted server, adds interaction-signal analysis (the widget collects those signals by default) and a spam classifier, among other things. The fallback challenge, a code read from an image or an audio clip, needs Sentinel or a server implementation of your own.
Sentinel from €99 a month, the cloud from €47. Sentinel Professional covers up to three instances; without a key it runs as a 30-day trial, and production use requires a license. Sentinel is not MIT-licensed: on GitHub, the altcha-org organization publishes only its deployment scripts and Helm charts. The EU-hosted Cloud plan includes 1,000 requests a day and three sites. The free WordPress plugin covers login, registration and comments; protecting Contact Form 7 or WooCommerce takes the €18.90-a-month plan.
Cookie-free only by default. The widget submits its proof in a hidden form field, but the server can switch it to a cookie through the X-Altcha-Config header.
WCAG conformance is the vendor's own claim. ALTCHA's compliance page names no external audit of the widget and leaves final responsibility with whoever integrates it.
Verification bugs fixed in October 2026. v3.0.0, released on April 7, 2026, rewrote the widget and its proof-of-work, and 16 releases followed up to v3.3.0 on October 5. That release closes a verifySolution bypass in altcha/lib: when the key signature was missing, any counter passed without any work being done. The same day, altcha-lib 2.6.0 fixed another bypass and two replay-protection flaws; the Go library had already retracted v2.0.0 through v2.3.0 on October 3.