# altcha: Self-Hosted CAPTCHA Alternative with Proof of Work This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/altcha-org-altcha Generated for open source discovery and AI-assisted research. ALTCHA is a TypeScript web component for self-hosted, privacy-first protection against spam and abuse, using proof of work instead of visual puzzles. It avoids tracking and fingerprinting, with accessibility features and server integrations for multiple languages. GitHub: https://github.com/altcha-org/altcha OSRepos URL: https://osrepos.com/repo/altcha-org-altcha ## Summary ALTCHA is a TypeScript web component for self-hosted, privacy-first protection against spam and abuse, using proof of work instead of visual puzzles. It avoids tracking and fingerprinting, with accessibility features and server integrations for multiple languages. ## Topics - typescript - security - privacy - self-hosted - captcha - proof-of-work ## Repository Information Last analyzed by OSRepos: Sun Nov 08 2026 09:21:35 GMT+0000 (Western European Standard Time) Detail views: 3 GitHub clicks: 1 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview ALTCHA is a self-hosted security solution built around a proof-of-work (PoW) mechanism. Its TypeScript web component protects websites, APIs, and online services from spam and abuse without relying on third-party CAPTCHA services, tracking cookies, or browser fingerprinting. Visitors can complete verification through background computation rather than traditional visual puzzles. Teams add the widget to forms and connect it to a server-side integration that issues and verifies challenges. The project emphasizes GDPR compliance and accessibility, including WCAG 2.2 AA and European Accessibility Act compliance. ## Key Features - Uses background proof of work to verify visitors without standard visual puzzles. - Supports PBKDF2 and SHA algorithms by default, with optional Argon2 and Scrypt workers. - Provides image and audio code-challenge fallbacks through ALTCHA Sentinel or a custom server implementation. - Ships as a Web Component that can be installed from npm and added to forms. - Offers multiple widget layouts, configuration options, events, and more than 50 languages. - Supports server integrations in TypeScript, Dart, PHP, Go, Python, Java, Ruby, Elixir, Rust, and C++. - Can send verification payloads as form fields or cookies, and supports a strict-CSP bundle option. ## Use Cases - A website team wants to protect contact or signup forms without sending visitor data to an external CAPTCHA provider. - An API operator needs a challenge-and-verification flow to reduce automated spam or abuse. - An accessibility-focused service needs alternatives to visual puzzles, including audio and code challenges. - A team running its own infrastructure wants to choose proof-of-work settings and integrate verification with its existing server stack. ## Our Take ALTCHA is an actively maintained, self-hosted CAPTCHA alternative with a broad integration ecosystem, though its development is concentrated in one contributor. **Good fit if:** - You want privacy-first, self-hosted spam protection based on proof of work. - Your frontend can use Web Components and the Web Crypto API, and you can implement server-side challenge verification. - Accessibility and support for multiple server languages are important to your integration. **Look elsewhere if:** - You need a solution that does not require operating or integrating a verification server. - You must support Internet Explorer 11 or browsers without Web Crypto API support. - Your team requires a project with a broader contributor base, since most of the code comes from one person. ## Project Health | Signal | Value | |---|---| | Status | **Active**: regular commits and releases | | Last commit | 2026-10-22 (17 days ago) | | Commits, last 90 days | 21 | | Releases, last 12 months | 21 (latest v3.5.0, 2026-10-22) | | Contributors | 1 | | Issues closed, last 90 days | 8 (typically closed in 2 days) | | Project age | 2 years | Checked on 2026-11-08 with the GitHub API. ## Project Facts - Language: TypeScript - License: MIT - Stars: 2.9k - Forks: 143 - Topics: anti-abuse, anti-bot, antispam, captcha, captcha-alternative, ddos-mitigation, ddos-protection, hcaptcha - Website: https://altcha.org - Archived: no ## What You Need Detected in the repository: - Node.js (from package.json) - A test suite and automated checks on GitHub Actions ## Getting Started Install the widget from npm and import it in your application: ```sh npm install altcha ``` ```js import 'altcha'; ``` Add an `` to a form and configure it with a challenge endpoint. See the [README](https://github.com/altcha-org/altcha) and [integration documentation](https://altcha.org/docs/integration/widget/) for configuration and server setup. ## License in Plain Words **MIT** (permissive). - Commercial use: yes - Modify and redistribute: yes - You must keep: the copyright and license notice - Share your changes: no A summary, not legal advice: the LICENSE file is what applies. ## Considerations - The project is active, with regular commits and releases, and issues are typically handled quickly. However, development is concentrated in a single contributor, which can make continuity dependent on that maintainer. - Widget support depends on Web Components and the Web Crypto API. Internet Explorer 11 and older are explicitly unsupported. - The widget alone is not the full verification system. You need a compatible server integration, and image or audio code challenges require ALTCHA Sentinel or a custom implementation. - Argon2 and Scrypt require separate worker imports and registration. They are not bundled in the default widget setup. - ALTCHA describes its privacy and accessibility compliance in the README. Teams should assess those claims against their own legal and accessibility requirements.