Cap (Cap.js) is an open-source, self-hosted CAPTCHA designed to replace hosted challenges such as reCAPTCHA. Instead of asking visitors to click traffic lights, it verifies them invisibly with proof-of-work puzzles and server-side browser checks, and it keeps every byte of that process on infrastructure its operator controls. It serves teams that already run their own servers and want bot protection without feeding visitor data to a third-party tracker.[1][2]
Quick verdict
Cap suits small-to-mid product and engineering teams that self-host their stack and want to drop reCAPTCHA's tracking for a private, invisible check. Its strength is the combination of SHA-256 proof-of-work with server-side validation and instrumentation challenges, delivered through a roughly 20 kB cookie-free widget with a reCAPTCHA-compatible verify endpoint for migration. The material constraint is operational: there is no generally available hosted version, since Cap.js Cloud remains a waitlisted private beta, so somebody on the team must run the Docker or Node server. If the team can self-host, Cap is a strong privacy-first choice; if it needs zero-operations managed protection, it should use the CAPTCHA bundled with its auth or hosting platform instead.[1][2][3]
Key features
Invisible proof-of-work challenges Challenges solve silently in the browser using SHA-256 computation, so genuine visitors pass without clicking anything while bulk attackers pay compute for every attempt.[1][2]
Server-side validation and instrumentation checks Solutions are verified and the browser environment is probed on the operator's own server, adding a second layer behind the puzzle itself.[1][2]
Optional WASM time-lock puzzles Operators can trade a heavier client check (around 690 kB) for stronger resistance where abuse pressure justifies it.[1][2]
reCAPTCHA-compatible verify endpoint A siteverify-style endpoint makes migrating an existing reCAPTCHA integration a configuration change rather than a rewrite.[1]
Three deploy shapes Deploy as a standalone all-in-one Docker image, install the server package into an existing Node application, or join the waitlist for the managed Cap.js Cloud.[1][2]
Tiny default footprint The standard widget is near 20 kB with zero third-party requests, and the server ships as a 22 MB Docker image.[1][2]
Events, webhooks, and admin dashboard Verification activity is exposed through events and webhooks, with multiple site keys managed from a dashboard and custom branding for visible widget states.[1]
Privacy-first data posture No cookies and no tracking, verification stays inside the operator's infrastructure, and the project presents this as GDPR and CCPA compliant. Compliance wording is the project's presentation, not a legal determination.[1][2]
Who will love it
Privacy-regulated teams replacing reCAPTCHA get an Apache-2.0 codebase with no cookies, no cross-site profiling, and verification data that never leaves their own servers.[1][2]
Self-hosting shops already running Docker or Node can add the standalone image or the server package to existing infrastructure and manage keys from the included dashboard.[1][2]
Login and signup flows sensitive to friction benefit from a check most visitors never notice, replacing puzzle abandonment with a silent background computation.[1]
Who should avoid it
Teams with nobody to run a server should not adopt infrastructure they cannot operate; with Cap.js Cloud still in private beta, there is no managed fallback today.[1]
A managed WAF, native mobile SDKs, and a WordPress plugin are listed as coming soon, so high-abuse targets needing them today fit a mature hosted mitigation better.[1]
Performance-critical pages on weak devices should measure the heavier challenge modes first, since the strongest puzzles cost hundreds of kilobytes the default widget avoids.[1]
How people experience it
Indirect public reception sample only: repository stars and forks, AlternativeTo listing rank and likes, named production sponsors, and Logto v1.44.0 provider adoption. No original Reddit or G2 user reports were located within budget, so no verbatim testimonials are included.
2 cited community sources. Adoption proxies are not satisfaction scores. No independent measurements of bypass rates, solve latency, or accessibility outcomes were found. A further search beyond the research budget might locate user reports.
Public reception is indirect but strong: roughly 8,000 stars and 700-plus forks, a top-10 AlternativeTo reCAPTCHA-alternative ranking, named production sponsors, and first-class adoption in Logto v1.44.0. These are adoption proxies, not satisfaction scores.[1][2][3]
No original Reddit or G2 user reports were located within the research budget, so no verbatim testimonials are included and the effectiveness case rests on project reasoning plus adoption rather than third-party test results.[1]
Migration and platform fit
Questions worth asking
What is the best Cap alternative for non-technical users?
Is Cap really no-code?
No. Embedding the widget, deploying the Docker image or Node server, and wiring server-side verification are developer tasks documented in the official quickstart.[1]
How much does Cap cost per month?
Sources and editorial review
Source research. Reviewed on October 9, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
Indirect public reception sample only: repository stars and forks, AlternativeTo listing rank and likes, named production sponsors, and Logto v1.44.0 provider adoption. No original Reddit or G2 user reports were located within budget, so no verbatim testimonials are included. Adoption proxies are not satisfaction scores. No independent measurements of bypass rates, solve latency, or accessibility outcomes were found. A further search beyond the research budget might locate user reports.
- Cap homepage
official · Observed October 9, 2026
Official homepage: mechanism, privacy posture, footprint, deploy shapes, managed-cloud beta state, production sponsors, roadmap.
- Cap quickstart guide
official · Observed October 9, 2026
Official quickstart: npm packages, createServer config, Express middleware, standalone Docker image, challenge modes, token expiry.
- tiagozip/cap repository
official · Observed October 9, 2026
Repository README: stars and forks, Apache-2.0 license, invisible PoW plus WASM puzzles, widget and image sizes, sponsors.
- Cap effectiveness guide (fork mirror of official docs)
community · Observed October 9, 2026
Unofficial fork mirror of the official effectiveness guide; project-authored economic reasoning, not an independent measurement.
- AlternativeTo Cap page
community · Observed October 9, 2026
Third-party listing: free and open-source, top-10 reCAPTCHA alternative with 28 likes at observation; like count is a reception signal, not a satisfaction score.
- Logto v1.44.0 release notes
official · Observed October 9, 2026
Logto v1.44.0 release notes from early October 2026: Cap joins the supported CAPTCHA providers; OSS self-hosters run their own instance.