Private Captcha is a privacy-first proof-of-work CAPTCHA that blocks bots with invisible cryptographic checks instead of puzzles, tracking, or cookies. Site owners embed a lightweight widget and verify tokens server-side while difficulty adapts automatically to attack patterns. It suits EU-focused teams that need GDPR-friendly bot protection, from individual site owners to small and mid-market teams with someone able to run a Docker-based instance.[1][2][3]
Quick verdict
Teams that need GDPR-friendly bot protection with no puzzles and an EU-made, self-hostable option will get the most from Private Captcha. Its invisible proof-of-work widget, adaptive difficulty with custom traffic rules, and Docker Compose self-hosting cover website and form protection for privacy-conscious operators. Teams that need commercial use without a license fee, or buyers who require documented SSO, support SLAs, and independent user reviews, should verify terms first or look at a fully free alternative. If you can self-host with Docker and accept the noncommercial community terms, start with the community edition; if you need commercial or enterprise use, contact Intmaker OÜ for a license and trial the managed cloud in the meantime.[1][2][3]
Key features
Invisible proof-of-work checks instead of puzzles The browser solves a cryptographic task in the background, so legitimate visitors never see challenges while bots are filtered before submission.[1][2]
Adaptive difficulty that scales exponentially The system tunes task difficulty to current access patterns automatically, making sustained attacks disproportionately expensive without punishing normal traffic.[1]
Custom rules by traffic source, country, and address Operators can adjust difficulty, change scaling, or block requests outright based on traffic source, country, CIDR range, user agent, or headers, including known-bot detection.[1]
Form proxy for webhook protection The proxy hides form endpoints behind a rate-limit and CAPTCHA check, shielding webhooks and inboxes from direct abuse.[1]
Go backend on ClickHouse and Postgres The service is built for low resource requirements, with a documented stack of Go, ClickHouse, and PostgreSQL behind the verification API.[1]
Platform and Verify APIs for automation Server-side token verification plus a platform API for managing organizations, domains, and forms let teams wire checks into their own backends rather than trusting the browser.[1][2]
Broad integration ecosystem Documented libraries and plugins cover WordPress, Magento 2, TYPO3, React, Vue, JavaScript, Python, PHP, .NET, JVM, Ruby, and Go, with a migration tutorial for teams leaving reCAPTCHA.[1]
Usage statistics with weekly and monthly reports Domain- and organization-level dashboards show how properties are accessed, helping operators pick difficulty settings and spot abuse.[1]
Who will love it
No behavior tracking, no personal data processing, and no cookies remove whole classes of consent-banner and data-processing friction for EU-facing sites.[1][2]
The quickstart pairs a bootstrap script with domain, reverse-proxy, and license-key setup that a Docker-capable operator can complete in one session.[1][2]
A documented reCAPTCHA migration path plus dedicated incumbent comparisons give puzzle-fatigued teams a concrete route to invisible checks.[1][2]
Who should avoid it
The community edition covers non-commercial use only; commercial and enterprise deployments require a paid license under EULA terms.[1][2][3]
With no Reddit or G2 reports collected in this pass and the inspected sample limited to official pages plus repository records, there is little third-party confirmation of day-to-day behavior under real attack traffic.[1][2]
Self-hosting needs Docker, a domain, and a reverse proxy, so teams without that capacity should use the managed cloud trial rather than assuming self-hosting is zero-operations.[1][2]
Alternatives and compatibility
Against image-puzzle CAPTCHAs, Private Captcha's background proof-of-work removes visitor friction but moves integration work to the operator's backend, which must verify every token.[1][2]
Against fully managed hosted checks, Private Captcha competes on data control and self-hosting rather than zero-operations convenience; pick the hosted route when no one can run a server.[1][2]
Against same-class proof-of-work projects, its distinction is adaptive exponential difficulty with custom traffic rules plus a commercial enterprise edition; choose it when rule-driven scaling and EU-made GDPR positioning are requirements, not preferences.[1][2]
Questions worth asking
What is the best Private Captcha alternative for non-technical users?
Is Private Captcha really no-code?
The widget embed itself is a snippet and the dashboard handles difficulty rules visually, but a working deployment needs operator work: a hosted or self-hosted instance, a configured property, and backend code that verifies tokens. Only teams with someone able to do that setup should treat it as low-effort.[1][2][3]
How much does Private Captcha cost per month?
The community edition costs nothing for non-commercial use, as checked October 12, 2026. Commercial and enterprise use require a paid license under EULA terms via direct contact, and the managed cloud offers a free trial; exact per-month plan prices were not confirmed in this pass, so verify current pricing on the official pricing section before budgeting.[1][2][3]
Can you self-host Private Captcha?
Yes. Self-hosting is a first-class distribution model with a Docker Compose quickstart, a dedicated self-hosting repository, community and enterprise images with license keys, and production guidance for three subdomains behind Nginx or Caddy. Local-only installs are possible for evaluation.[1][2][3]
Sources and editorial review
Source research. Reviewed on October 12, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- Private Captcha features
official · Observed October 12, 2026
Official features page: adaptive difficulty, custom rules, form proxy, Go/ClickHouse/Postgres backend, widget, usage stats, platform API, integrations, incumbent comparison pages, hosted portal signup with free trial. Observed 2026-10-12.
- PrivateCaptcha/PrivateCaptcha repository
official · Observed October 12, 2026
Official repository: PrivateCaptcha/PrivateCaptcha, independent EU-made PoW CAPTCHA; 197 stars, 8 forks, 1,606 commits; Go backend with JS widget; PolyForm Noncommercial license with commercial enterprise licenses. Observed 2026-10-12.
- Private Captcha LICENSE
official · Observed October 12, 2026
Raw LICENSE file: PolyForm Noncommercial License 1.0.0, Required Notice naming Copyright Intmaker OÜ. Observed 2026-10-12.
- Private Captcha self-hosting
official · Observed October 12, 2026
Official self-hosting repository: Docker Compose quickstart, community vs enterprise editions under EULA, CE/EE license keys and images. Observed 2026-10-12.
- Private Captcha documentation
official · Observed October 12, 2026
Official docs home: Verify/Platform API references, reCAPTCHA migration tutorial, integrations, deployment section, status page, Intmaker OÜ copyright. Observed 2026-10-12.
- Private Captcha deployment quickstart
official · Observed October 12, 2026
Official deployment quickstart: Docker/domain prerequisites, bootstrap script, compose, license keys, three-subdomain production guidance with Nginx/Caddy. Observed 2026-10-12.