[opensourcedex]

Private Captcha is a free, open source application security project written in Go and released under a custom open-source licence. It has 195 GitHub stars, 6 forks and 4 open issues, and was last pushed 6 hours ago. On this registry it ranks #14 of 16 tracked projects in Application Security, with 5 head-to-head comparisons available. It gained 1 stars over the last 6 tracked days.

What is Private Captcha?

What it is

Private Captcha is an independent, privacy-first, self-hostable Proof-of-Work CAPTCHA service built in the European Union. The project provides bot protection for web applications by asking visitors to solve a computational challenge rather than identifying distorted images or clicking through behavioral tests. The backend is written in Go and serves both the API and the portal, while the client side ships as a JavaScript widget that uses WebAssembly workers where possible. Business data such as accounts and properties is stored in Postgres, and operational data such as difficulty scaling and statistics is stored in ClickHouse. A self-hosting setup lives in a separate repository, with configuration documented on the project's documentation site.

The concrete problem it solves is the friction and privacy cost of mainstream CAPTCHA systems. Traditional challenges interrupt legitimate users, and the hosted services behind them process visitor signals that complicate GDPR compliance. Private Captcha replaces that with a Proof-of-Work challenge whose difficulty adapts to traffic conditions, so honest visitors spend computation instead of attention. Because the service can run on the operator's own infrastructure, no visitor data has to leave that infrastructure, and the README states that the project performs no behavior tracking and no PII processing. It lives in the anti-bot and anti-abuse ecosystem alongside other invisible and proof-of-work CAPTCHA alternatives.

Key capabilities

  • Adaptive challenge difficulty with multiple configuration options, so protection scales with observed traffic conditions.
  • Optimized Go backend with low resource requirements.
  • Lightweight, customizable JavaScript widget, including an "invisible" version.
  • Usage statistics available in the backend portal.
  • Privacy-focused design with no behavior tracking and no PII processing.
  • Proof-of-Work challenges aimed at bots, spam, and AI scrapers.
  • OpenAPI specification published in the repository for API integration.

Who uses it and how

  • Site operators who want to keep visitor traffic and challenge data on their own infrastructure rather than on a third-party service.
  • Teams protecting public forms, sign-ups, and comment endpoints against spam and automated abuse.
  • Operators facing scraping or flood traffic who want a proof-of-work gate instead of a visual puzzle.
  • Organizations in the European Union that need bot protection aligned with GDPR obligations.
  • Developers integrating through the documented HTTP API or by embedding the client widget in a web page.

Getting started

Clone the

project readme (upstream, from github) — read inline

GitHub go.mod Go version

CI Go Lint JS lint

Maintainability Rating Reliability Rating Security Rating Coverage

Private Captcha is an independent, privacy-first, self-hostable Proof-of-Work CAPTCHA service made in EU.

About

Project goals

  • provide powerful means to fight bots, including AI scrapers, and spam even as AI improves
  • make web a slightly better place by replacing existing frustrating CAPTCHAs
  • stay focused on privacy and GDPR compliance as well as on-prem deployment
  • provide stable, backward-compatible and reliable API and integrations
  • be sustainable financially to fulfill previous goals long enough

Features

  • adaptive challenge difficulty (including various configuration options)
  • optimized backend (low resource requirements)
  • lightweight, customizable widget (including "invisible" version)
  • usage statistics (backend)
  • privacy-focused, no behavior tracking or PII processing

Documentation

Please refer to the official documentation.

Getting started

To spin up a local version of Private Captcha for development, clone this repository and run make run-docker in the root (it requires to have Docker installed). You can check Makefile for details of what it does exactly.

OpenAPI / Swagger

OpenAPI spec is available.

Project structure

├── cmd/                              Main executable of the server and few helpers
├── docker/                           Development-only docker files
├── docs/                             Developer documentation snippets
├── Makefile
├── pkg/                              Backend part of the project (API and Portal)
├── web/                              Frontend part of the project (Portal)
└── widget/                           Client-side widget code

Built with

  • Go for backend (API and Portal)
  • JavaScript (inevitably) for client widget, including WASM workers (where possible)
  • Postgres for "business" data (accounts, properties etc.)
  • ClickHouse for "operational" data (difficulty scaling, statistics etc.)
  • TailwindCSS for Portal (backend)

Self-hosting

Self-hosting setup is in another repository and documentation - on main docs website.

Alternatives

Private Captcha is a private and open alternative to:

Comparisons

DISCLAIMER: just like other similar tables, this reflects an author's opinion more than "legal reality"

Feature Private Captcha Friendly Captcha Cap Altcha CloudFlare Turnstile Google reCAPTCHA hCAPTCHA
User-friendly :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :x: :x:
GDPR-compliant :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark: :yellow_circle: :yellow_circle:* :yellow_circle:*
Self-hostable :white_check_mark: :yellow_circle:* :white_check_mark: :white_check_mark: :x: :x: :x:
Difficulty scaling :white_check_mark: :white_check_mark: :yellow_circle: :white_check_mark: :white_check_mark: :yellow_circle: :yellow_circle:
High-throughput* :white_check_mark: :white_check_mark: :x: :x: :white_check_mark: :yellow_circle: :yellow_circle:
Sustainable* :white_check_mark: :white_check_mark: :x: :white_check_mark: :white_check_mark: :white_check_mark: :white_check_mark:

NOTE: Friendly Captcha actually offers some kind of abandoned PHP implementation of static (no scaling) difficulty puzzles, but it's obviously unusable in real production

NOTE: "High-throughput" means low-latency backend (e.g. no Javascript on the backend, like in Cap and Altcha), profiled and optimized

NOTE: "Sustainable" means this project has means to survive (which, for example, in Google/CloudFlare case is "indefinitely" due to other kinds of revenue). Private Captcha, Altcha have a managed/SaaS offering that is fueling the development.

NOTE: reCAPTCHA and hCAPTCHA both self-declare to be GDPR-compliant, but since there was no court precedent to prove otherwise at the time of writing, they both collect excessive amounts of user tracking data.

License

This project is distributed under a PolyForm Noncommercial License (see LICENSE for more information). This allows you to self-host community edition of Private Captcha for non-commercial use. Commercial licenses available for enterprise edition - please contact us at [email protected]

Back to top

Frequently asked questions

Is Private Captcha free to use?

Private Captcha is open source. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Private Captcha do?

GDPR-compliant bot protection without user friction

What is Private Captcha written in?

Private Captcha is primarily written in Go. Its source is publicly available at https://github.com/privatecaptcha/privatecaptcha, and it has 195 GitHub stars.