[opensourcedex]

mCaptcha is a free, open source application security project written in Rust and released under AGPL-3.0. It has 2,490 GitHub stars, 93 forks and 54 open issues, and was last pushed 12 months ago. On this registry it ranks #10 of 16 tracked projects in Application Security, with 5 head-to-head comparisons available. It gained 3 stars over the last 6 tracked days.

What is mCaptcha?

What it is

mCaptcha is a privacy-first proof-of-work CAPTCHA system written in Rust and licensed under AGPL-3.0. It operates as a backend component within the self-hosted application security ecosystem, where it provides CAPTCHA, spam protection, and DDoS mitigation for websites and services. The project replaces traditional image-based user interaction with an automated computational challenge, so the client device performs the work instead of the human user.

The concrete problem it solves is the trade-off between abusive traffic and user friction. mCaptcha uses SHA256-based proof-of-work to rate-limit users. A user clicks a button, the browser generates a short-lived proof, and the proof is validated by the mCaptcha service. If validation succeeds, the user receives a token that the target website must validate before processing the request. This makes repeated requests computationally expensive for attackers while keeping normal users out of the way.

Key capabilities

  • It uses SHA256 proof-of-work as the core challenge mechanism.
  • It issues a token after proof validation, and the target website validates that token before accepting the request or form submission.
  • It adjusts proof-of-work difficulty under load, with no delay under moderate load and up to two seconds under attack.
  • It uses cookie-free CAPTCHA routes, so the service does not rely on tracking cookies for the challenge flow.
  • It is independent of the user IP address, which helps users behind NAT.
  • It resists replay attacks because proof-of-work configurations have a thirty-second lifetime and can be used only once.
  • It is distributed as a self-hosted Rust and Actix Web component with Docker Compose deployment.

Who uses it and how

  • Website operators place a client-side widget on sign-up or form pages, then validate the returned token on the backend.
  • Self-hosted application stacks use it to reduce spam and abusive requests without sending users through image-based challenges.
  • Services that need DDoS mitigation can make attackers spend more client-side computation than the server spends on response handling.
  • Developers can test the flow against public demo servers or the widget demo before deploying their own instance.

Getting started

The README shows self-hosting by cloning the repository and running docker-compose up -d, and it also provides the mcaptcha/mcaptcha Docker image. Public demo servers are available at https://demo.mcaptcha.org/ and https://demo2.mcaptcha.org/.

When to use it — and when not to

mCaptcha fits teams that want a self-hosted, privacy-focused CAPTCHA alternative and can operate a Docker Compose deployment and the database mentioned by the project. It is less suitable for production deployments that require a stable release, because the project is still in active development and the README says core functionality is work-in-progress. The hosted demo servers may lag behind the master branch, and the demo database is frequently wiped, so operators should not rely on the public demos as a durable service.

project readme (upstream, from github) — read inline

mCaptcha

Proof of work based, privacy respecting CAPTCHA system with a kickass UX.

Documentation Build Docker dependency status codecov
AGPL License Chat

STATUS: ACTIVE DEVELOPMENT

Skip to demo

mCaptcha is a privacy respecting, free CAPTCHA system with a kickass UX. Your users no longer have to interact with ridiculous image-based CAPTCHA system, wasting precious mental bandwidth. Instead, your computer will do the work for you, see for yourself!

How does it work?

mCaptcha uses SHA256 based proof-of-work (PoW) to rate limit users.

When a user wants to do something on a mCaptcha-protected website,

  1. they will have to generate proof-of-work (a bunch of math that will takes time to compute) and submit it to mCaptcha.

  2. We'll validate the proof:

    • if validation is unsuccessful, they will be prevented from accessing their target website
    • if validation is successful, read on,

  3. They will be issued a token that they should submit along with their request/form submission to the target website.

  4. The target website should validate the user-submitted token with mCaptcha before processing the user's request.

The whole process is automated from the user's POV. All they have to do is click on a button to initiate the process.

mCaptcha makes interacting with websites (computationally) expensive for the user. A well-behaving user will experience a slight delay (no delay when under moderate load to 2s when under attack; PoW difficulty is variable) but if someone wants to hammer your site, they will have to do more work to send requests than your server will have to do to respond to their request.

Why use mCaptcha?

  • Free software, privacy focused
  • Seamless UX - No more annoying CAPTCHAs!
  • No tracking: Our CAPTCHA routes are cookie free!
  • IP address independent: your users are behind a NAT? We got you covered!
  • Resistant to replay attacks: proof-of-work configurations have short lifetimes (30s) and can be used only once. If a user submits a PoW to an already used configuration or an expired one, their proof will be rejected.

Demo

Client-side widget:

mCaptcha's UX is super silent, solving CAPTCHAs have never been more easier. One click and you are on your way. To observe mCaptcha in action, open dev tools and monitor console and network activity.

  1. Link to widget

  2. Video:

Demo servers are available at:

Core functionality is working but it's still very much work-in-progress. Since we don't have a stable release yet, hosted demo servers might be a few versions behind master. Please check footer for build commit.

Feel free to provide bogus information while signing up (project under development, database frequently wiped).

Self-hosted:

Clone the repo and run the following from the root of the repo:

git clone https://github.com/mCaptcha/mCaptcha.git
docker-compose up -d

After the containers are up, visit http://localhost:7000 and login with the default credentials:

  • username: aaronsw
  • password: password

It takes a while to build the image so please be patient :)

See DEPLOYMENT.md for detailed alternate deployment methods.

Development:

See HACKING.md

Deployment:

See DEPLOYMENT.md

Configuration:

See CONFIGURATION.md

Funding

NLnet


2023 development is funded through the NGI0 Entrust Fund, via NLnet. Please see here for more details.

Frequently asked questions

Is mCaptcha free to use?

mCaptcha is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does mCaptcha do?

Privacy-first proof-of-work CAPTCHA without user friction

What is mCaptcha written in?

mCaptcha is primarily written in Rust. Its source is publicly available at https://github.com/mcaptcha/mcaptcha, and it has 2,490 GitHub stars.