{"name":"altcha: Self-Hosted CAPTCHA Alternative with Proof of Work","description":"ALTCHA is a TypeScript web component for self-hosted, privacy-first protection against spam and abuse, using proof of work instead of visual puzzles. It avoids tracking and fingerprinting, with accessibility features and server integrations for multiple languages.","github":"https://github.com/altcha-org/altcha","url":"https://osrepos.com/repo/altcha-org-altcha","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/altcha-org-altcha","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/altcha-org-altcha.md","json":"https://osrepos.com/repo/altcha-org-altcha.json","topics":["typescript","security","privacy","self-hosted","captcha","proof-of-work"],"keywords":["typescript","security","privacy","self-hosted","captcha","proof-of-work"],"stars":null,"summary":"ALTCHA is a TypeScript web component for self-hosted, privacy-first protection against spam and abuse, using proof of work instead of visual puzzles. It avoids tracking and fingerprinting, with accessibility features and server integrations for multiple languages.","content":"## Overview\n\nALTCHA is a self-hosted security solution built around a proof-of-work (PoW) mechanism. Its TypeScript web component protects websites, APIs, and online services from spam and abuse without relying on third-party CAPTCHA services, tracking cookies, or browser fingerprinting.\n\nVisitors can complete verification through background computation rather than traditional visual puzzles. Teams add the widget to forms and connect it to a server-side integration that issues and verifies challenges. The project emphasizes GDPR compliance and accessibility, including WCAG 2.2 AA and European Accessibility Act compliance.\n\n## Key Features\n\n- Uses background proof of work to verify visitors without standard visual puzzles.\n- Supports PBKDF2 and SHA algorithms by default, with optional Argon2 and Scrypt workers.\n- Provides image and audio code-challenge fallbacks through ALTCHA Sentinel or a custom server implementation.\n- Ships as a Web Component that can be installed from npm and added to forms.\n- Offers multiple widget layouts, configuration options, events, and more than 50 languages.\n- Supports server integrations in TypeScript, Dart, PHP, Go, Python, Java, Ruby, Elixir, Rust, and C++.\n- Can send verification payloads as form fields or cookies, and supports a strict-CSP bundle option.\n\n## Use Cases\n\n- A website team wants to protect contact or signup forms without sending visitor data to an external CAPTCHA provider.\n- An API operator needs a challenge-and-verification flow to reduce automated spam or abuse.\n- An accessibility-focused service needs alternatives to visual puzzles, including audio and code challenges.\n- A team running its own infrastructure wants to choose proof-of-work settings and integrate verification with its existing server stack.\n\n## Our Take\n\nALTCHA is an actively maintained, self-hosted CAPTCHA alternative with a broad integration ecosystem, though its development is concentrated in one contributor.\n\n**Good fit if:**\n- You want privacy-first, self-hosted spam protection based on proof of work.\n- Your frontend can use Web Components and the Web Crypto API, and you can implement server-side challenge verification.\n- Accessibility and support for multiple server languages are important to your integration.\n\n**Look elsewhere if:**\n- You need a solution that does not require operating or integrating a verification server.\n- You must support Internet Explorer 11 or browsers without Web Crypto API support.\n- Your team requires a project with a broader contributor base, since most of the code comes from one person.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-10-22 (17 days ago) |\n| Commits, last 90 days | 21 |\n| Releases, last 12 months | 21 (latest v3.5.0, 2026-10-22) |\n| Contributors | 1 |\n| Issues closed, last 90 days | 8 (typically closed in 2 days) |\n| Project age | 2 years |\n\nChecked on 2026-11-08 with the GitHub API.\n\n## Project Facts\n\n- Language: TypeScript\n- License: MIT\n- Stars: 2.9k\n- Forks: 143\n- Topics: anti-abuse, anti-bot, antispam, captcha, captcha-alternative, ddos-mitigation, ddos-protection, hcaptcha\n- Website: https://altcha.org\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Node.js (from package.json)\n- A test suite and automated checks on GitHub Actions\n\n## Getting Started\n\nInstall the widget from npm and import it in your application:\n\n```sh\nnpm install altcha\n```\n\n```js\nimport 'altcha';\n```\n\nAdd an `<altcha-widget>` to a form and configure it with a challenge endpoint. See the [README](https://github.com/altcha-org/altcha) and [integration documentation](https://altcha.org/docs/integration/widget/) for configuration and server setup.\n\n## License in Plain Words\n\n**MIT** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the copyright and license notice\n- Share your changes: no\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Considerations\n\n- The project is active, with regular commits and releases, and issues are typically handled quickly. However, development is concentrated in a single contributor, which can make continuity dependent on that maintainer.\n- Widget support depends on Web Components and the Web Crypto API. Internet Explorer 11 and older are explicitly unsupported.\n- The widget alone is not the full verification system. You need a compatible server integration, and image or audio code challenges require ALTCHA Sentinel or a custom implementation.\n- Argon2 and Scrypt require separate worker imports and registration. They are not bundled in the default widget setup.\n- ALTCHA describes its privacy and accessibility compliance in the README. Teams should assess those claims against their own legal and accessibility requirements.","metrics":{"detailViews":3,"githubClicks":1},"dates":{"published":null,"modified":"2026-11-08T09:21:35.000Z"}}