DOCSEARCHbyAlgolia
Submit Docs

Cap

website·Indexed 30 days ago

https://capjs.js.org/

An open-source, self-hosted CAPTCHA alternative that uses GPU-resistant proof-of-work (HashWX) and instrumentation challenges to block bots without visual puzzles. It includes a client widget, a stateless server library (capjs-core), and a standalone Docker-based backend with a REST API. Cap provides middleware for Express and Elysia and is designed for privacy and compliance with GDPR, CCPA, and WCAG 2.2.

Tokens
19.2K
Snippets
67
Records
133
Agent score
72%

What's inside Cap

  1. Overview of Cap bot protection

    Cap is a free, open-source, self-hosted CAPTCHA alternative licensed under Apache 2.0. Unlike traditional CAPTCHAs that use visual puzzles or behavioral profiling, Cap uses proof-of-work and instrumentation challenges. Because it is self-hosted on the user's own infrastructure, visitor data is not routed through third-party vendors, simplifying GDPR and CCPA compliance.

  2. Overview of HashWX Proof of Work

    HashWX is Cap's default GPU-resistant proof-of-work challenge protocol. Unlike fixed hash functions (e.g., SHA-256), HashWX generates a new one-way function from a seed for every challenge. This design ensures that GPUs only gain a ~2x performance advantage over CPUs, compared to the ~150x advantage seen with SHA-256, making it highly effective for bot protection.

    Implementation Details:

    • Designed by tevador (creator of RandomX and HashX).
    • Cap uses a reference WebAssembly build.
    • Default for new Standalone keys.
    • In cap-core, it is opt-in via the format-2 API (SHA-256 remains the default there).

  3. Overview of Cap CAPTCHA

    Cap is a free, open-source (Apache 2.0), self-hosted CAPTCHA alternative that replaces traditional visual puzzles with a combination of proof-of-work (PoW) and instrumentation challenges. It is designed for teams prioritizing full control, privacy, and zero per-request fees. It operates as a single Docker container (with Valkey) and is compatible with the reCAPTCHA /siteverify API. It supports privacy-focused browsers like Brave, Librewolf, and Tor Browser.

  4. Overview of Cap open-source CAPTCHA

    Cap is a free, open-source, self-hosted CAPTCHA alternative licensed under Apache 2.0. Unlike traditional visual puzzles, it uses a two-layer protection system: GPU-resistant HashWX proof-of-work (PoW) and dynamic instrumentation challenges that verify the environment is a real browser. It provides a ~20 KB web-component widget and a compatible /siteverify endpoint for easy migration from reCAPTCHA.

  5. Overview of @cap.js/server

    @cap.js/server is a server-side library used to create and validate CAPTCHA challenges.

    Warning: This is a legacy library. New projects should use capjs-core, which is stateless, uses signed JWTs, and is compatible with Cloudflare Workers, Lambda, and edge environments.

  6. Compare Cap with other CAPTCHA alternatives

    Cap is a free, open-source, self-hosted CAPTCHA alternative that utilizes proof-of-work (PoW) and instrumentation challenges instead of image puzzles.

    Key advantages of Cap over alternatives include:

    • Privacy & Compliance: Fully GDPR compliant and does not track users or collect data.
    • User Experience: Lower challenge abandonment rates and higher compatibility with privacy-focused browsers (e.g., Brave, Librewolf) compared to fingerprinting-based solutions like Cloudflare Turnstile.
    • Control: Being self-hosted, developers control the difficulty and strictness of challenges rather than relying on a third-party algorithm.
    • Bot Resistance: Combines PoW with dynamic instrumentation challenges to resist commodity automation, headless browsers, and scripted attacks.
    • Cost: Completely free at any volume when self-hosted, unlike FriendlyCaptcha or SilentShield which have paid tiers.

    Trade-off: Cap does not offer managed hosting; users must run their own infrastructure.

  7. Compare Cap and hCaptcha for bot protection

    Cap is a self-hosted, open-source (Apache 2.0) CAPTCHA alternative designed to replace puzzle-based systems like hCaptcha. Key advantages of Cap include:

    • No Puzzles: Eliminates the 'puzzle tax' and associated conversion drop-off (typically 5-15% for hCaptcha).
    • Performance: Cap's client is ~20 KB, significantly smaller than hCaptcha's 600 KB+ client.
    • Cost: Cap is free at any scale and can run on a low-cost VPS, whereas hCaptcha Pro has monthly fees and per-request overages.
    • Privacy: Cap avoids browser fingerprinting and does not rely on a third-party domain (hcaptcha.com).
    • Deployment: Cap is fully self-hosted and can be run on air-gapped infrastructure.

  8. Implement bot protection using Cap Checkpoints

    Cap Checkpoints (formerly known as middlewares) provide a self-hosted, open-source proof-of-work CAPTCHA that acts as a browser-check interstitial. This mechanism blocks bots, LLMs, and automated abuse before they reach the website. Because this is a 'nuclear solution,' it will also impact legitimate bots, such as search engine crawlers.

  9. Compare Cap and Cloudflare Turnstile for bot protection

    Cap is a self-hosted, open-source (Apache 2.0) CAPTCHA alternative to Cloudflare Turnstile. While Turnstile is a fully managed service that relies on Cloudflare's network signals and browser fingerprinting, Cap provides the following advantages:

    • Self-hosting: Cap runs on your own servers, removing third-party dependencies and round-trips to Cloudflare.
    • Policy Control: Cap allows developers to control the difficulty level, whereas Turnstile's algorithmic decisions for 'suspicious' visitors cannot be overridden.
    • Privacy Compatibility: Cap uses proof-of-work rather than fingerprinting, resulting in lower error rates for users of hardened browsers (e.g., Brave, Librewolf, Tor) or VPNs.
    • Privacy & Telemetry: Cap does not set cookies or phone home, unlike Turnstile which communicates with challenges.cloudflare.com on every page load.
    • Customization: Cap supports CSS variables for colors, size, and shape, while Turnstile's iframe is mostly fixed.

  10. Ensure GDPR and CCPA compliance with Cap

    Cap meets GDPR and CCPA requirements by utilizing a self-hosted, open-source architecture. Because it is self-hosted, user data remains on the operator's own servers and never leaves their infrastructure. The system is designed without cookies, tracking, or third-party calls during the verification flow. Additionally, the proof-of-work mechanism is executed entirely within the visitor's browser, ensuring no sensitive data is transmitted to external entities.

  11. Improve conversion rates using Cap as a CAPTCHA alternative

    Traditional puzzle-based CAPTCHAs reduce conversion rates due to time/effort (10-26 seconds per solve), false positives for users on VPNs or privacy browsers (Brave, Tor, Librewolf), and accessibility barriers. Cap improves conversion by replacing visual puzzles and risk-score judgments with a deterministic proof-of-work (PoW) system and instrumentation challenges. Because it relies on the device's ability to perform a computation rather than a risk score, it avoids misclassifying privacy-conscious users.

  12. Compare Cap and Google reCAPTCHA

    Cap is a privacy-first, self-hosted, open-source (Apache 2.0) alternative to Google reCAPTCHA v2 and v3. Unlike reCAPTCHA, which sends user data to Google and often requires visual puzzles (e.g., traffic lights), Cap uses proof-of-work challenges that run on the user's own infrastructure.

    Key advantages of Cap over reCAPTCHA:

    • Privacy: No third-party scripts from google.com; all data stays on your infrastructure.
    • User Experience: No visual puzzles; users on VPNs, Tor, or privacy browsers are not silently penalized or locked out.
    • Performance: The Cap widget is ~20 KB, compared to reCAPTCHA's 500 KB+ client.
    • Cost: No per-request quotas or fees; it can run on a low-cost VPS.

    reCAPTCHA may still be preferable if you are deeply integrated with Google's identity stack, specifically require Google's v3 behavioral risk scores, or cannot run a backend service (e.g., a Docker container).