mCaptcha

Key features

• Proof-of-work challenges instead of puzzles The browser proves itself computationally, so legitimate visitors confirm with a click while bots and form spam get filtered before submission.[1][2]

• No tracking, cookies, or IP logging Verification runs without following visitors across the web, which is the core of the product's privacy positioning for sites that reject surveillance-backed CAPTCHAs.[1][2][3]

• Tiered site keys with easy or advanced setup Operators configure per-site difficulty levels from the dashboard, starting with a simple mode and moving to advanced tuning when traffic demands it.[1]

• Self-hosted deployment in three flavors Production-ready installs cover Docker, Ansible, and bare metal, so teams can run verification on infrastructure they already operate.[1][2]

• Widget plus backend verification flow The integration library can be self-served or loaded from a CDN with framework glue available, and every token is authenticated on the operator's backend rather than trusted from the browser.[1]

• Documented use without JavaScript A user manual covers running mCaptcha for visitors without JavaScript, alongside a CLI tool for operators who prefer the terminal.[1]

• AGPL-3.0 licensed public source The Rust backend and TypeScript/React management panel are public on GitHub, and the project's stated philosophy releases everything as free software.[1][2]

• DDoS-aware positioning with grant backing The project describes giving flood attackers a run for their money and is listed by NLnet as a funded reCAPTCHA and hCaptcha alternative.[1][2]

Who will love it

• One-click proof-of-work verification removes the abandonment and frustration of image-labeling challenges on logins, registrations, and contact forms.[1][2]

• Self-hosted Docker, Ansible, or bare-metal installs fit privacy-conscious organizations that cannot send visitor traffic data to a third-party CAPTCHA vendor.[1][2]

• With no paid tiers, usage caps, or per-seat billing documented, the only cost is the operator's own hosting.[1][2]

Who should avoid it

• Everything depends on an operator-run server: the demo instance is explicitly not for serious use, so there is no managed route for teams without server capacity.[1][2]

• With no Reddit or G2 reports found in this pass and the inspected sample limited to official pages plus the repository record, there is little third-party confirmation of day-to-day behavior under real attack traffic.[1][2]

• Neither single sign-on for the dashboard nor enterprise support terms are documented, so compliance-heavy buyers should verify these before committing.[1][2]

Alternatives and compatibility