Procaptcha is an open-source, frictionless CAPTCHA and bot-defense library for web developers who need human verification without the data collection and vendor lock-in of reCAPTCHA or hCaptcha.
What it is
Procaptcha is a drop-replacement CAPTCHA written in TypeScript and published under the Apache-2.0 licence from the Prosopo monorepo. It performs anti-spam, bot-detection, human-verification, and DDoS-mitigation work for websites and applications, and it is designed as a privacy-focused alternative to reCAPTCHA and hCaptcha. The project is distributed as a library that a site owner registers for and then embeds, so a sitekey issued by Prosopo is required before the library can be used.
The concrete problem it solves is data ownership at the verification step. Conventional CAPTCHA vendors sit between the visitor and the site and observe the interaction; Procaptcha states that it collects zero data and protects user privacy while still separating humans from bots. For teams that have to answer questions about GDPR compliance, third-party trackers, or where visitor signals end up, Procaptcha replaces the embedded vendor widget with one that the operator can register for and, where required, host themselves.
Key capabilities
- Drop-in replacement for reCAPTCHA, hCaptcha, and Cloudflare Turnstile, so an existing integration slot is reused rather than redesigned.
- Frictionless and invisible CAPTCHA modes, listed in the project topics as
frictionless-captcha and invisible-captcha.
- Zero data collection, positioning the widget as privacy-preserving rather than merely privacy-adjacent.
- Bot defence covering bot detection and anti-spam filtering, tagged
bot-detection, bot-defense, and antispam.
- Human verification for forms and application entry points, tagged
human-verification.
- DDoS mitigation and protection tags,
ddos-mitigation and ddos-protection, indicating the defence layer is not limited to single requests.
- Self-hosted operation is supported: the project states the software can be run as a self-hosted bot protection solution, with all required components open source except the client-side detection library.
Who uses it and how
- Site owners replacing an existing reCAPTCHA or hCaptcha widget on public-facing forms, keeping the same submission flow while changing the verification provider.
- Privacy-conscious teams that must document third-party data flows and prefer a CAPTCHA that collects zero visitor data.
- Applications that need verification before a free hosted signup, using a sitekey obtained from Prosopo.
- Organisations with data-residency or self-hosting requirements, running the stack themselves rather than depending on the hosted service.
- Development teams working inside the TypeScript monorepo, where setup for the development environment is documented in
for-devs.md.
Getting started
Sign up for free at https://prosopo.io/register to obtain a sitekey, which is required to use the library, then follow the documentation at https://docs.prosopo.io to add Procaptcha to a website or application. A self-hosted path is described in the project's GitHub discussions.
How it compares
The README names reCAPTCHA, hCaptcha, and Cloudflare Turnstile as the tools Procaptcha directly replaces, so it competes in the same integration slot on every page that already carries one of them. Its distinguishing claims are licence and control: the code is Apache-2.0, the stack can be self-hosted, and no visitor data is collected, whereas the named alternatives are operated as external services that the site owner does not run.
When to use it — and when not to
A self-hoster must accept that the client-side detection library is not open source, so the deployed system is not fully auditable even though the surrounding software is. Teams that want a single vendor-managed widget with no registration step should not pick it, and anyone unable to obtain a sitekey cannot use the library at all. The repository also shows 39 open issues and a README that is thin on deployment detail, so expect to lean on the discussion threads and documentation rather than the README alone.