altcha: Self-Hosted CAPTCHA Alternative with Proof of Work

Overview

ALTCHA is a self-hosted security solution built around a proof-of-work (PoW) mechanism. Its TypeScript web component protects websites, APIs, and online services from spam and abuse without relying on third-party CAPTCHA services, tracking cookies, or browser fingerprinting.

Visitors can complete verification through background computation rather than traditional visual puzzles. Teams add the widget to forms and connect it to a server-side integration that issues and verifies challenges. The project emphasizes GDPR compliance and accessibility, including WCAG 2.2 AA and European Accessibility Act compliance.

Key Features

• Uses background proof of work to verify visitors without standard visual puzzles.
• Supports PBKDF2 and SHA algorithms by default, with optional Argon2 and Scrypt workers.
• Provides image and audio code-challenge fallbacks through ALTCHA Sentinel or a custom server implementation.
• Ships as a Web Component that can be installed from npm and added to forms.
• Offers multiple widget layouts, configuration options, events, and more than 50 languages.
• Supports server integrations in TypeScript, Dart, PHP, Go, Python, Java, Ruby, Elixir, Rust, and C++.
• Can send verification payloads as form fields or cookies, and supports a strict-CSP bundle option.

Use Cases

• A website team wants to protect contact or signup forms without sending visitor data to an external CAPTCHA provider.
• An API operator needs a challenge-and-verification flow to reduce automated spam or abuse.
• An accessibility-focused service needs alternatives to visual puzzles, including audio and code challenges.
• A team running its own infrastructure wants to choose proof-of-work settings and integrate verification with its existing server stack.

Getting Started

Install the widget from npm and import it in your application:

npm install altcha

import 'altcha';

Add an <altcha-widget> to a form and configure it with a challenge endpoint. See the README and integration documentation for configuration and server setup.

Considerations

• The project is active, with regular commits and releases, and issues are typically handled quickly. However, development is concentrated in a single contributor, which can make continuity dependent on that maintainer.
• Widget support depends on Web Components and the Web Crypto API. Internet Explorer 11 and older are explicitly unsupported.
• The widget alone is not the full verification system. You need a compatible server integration, and image or audio code challenges require ALTCHA Sentinel or a custom implementation.
• Argon2 and Scrypt require separate worker imports and registration. They are not bundled in the default widget setup.
• ALTCHA describes its privacy and accessibility compliance in the README. Teams should assess those claims against their own legal and accessibility requirements.