ALTCHA

ALTCHA is an open-source, self-hosted CAPTCHA platform that protects websites, APIs, and online services from spam and abuse. It replaces traditional visual puzzles and intrusive verification methods with a proof-of-work mechanism to verify human users without relying on cookies or browser fingerprinting.

The software is deployed as a Web Component for the frontend and integrated with a server-side verification process. It is designed for developers and site administrators who require bot protection that adheres to strict privacy regulations and accessibility standards across all modern browsers supporting the Web Crypto API.

Key features

• Background Proof-of-Work (PoW) to eliminate visual puzzles
• Memory-bound Argon2 and Scrypt algorithms to resist GPU and ASIC acceleration
• Image-based code challenges with audio support for accessibility
• Cookie-free operation with no user tracking or data collection
• Compliance with WCAG 2.2 AA and the European Accessibility Act
• Self-hosted architecture to remove reliance on third-party APIs
• Lightweight bundle size of approximately 34 kB GZIPped
• Support for multiple UI layouts including floating, overlay, and invisible modes

The system utilizes the Web Crypto API to perform calculations in the browser, ensuring that the computational load is handled client-side. It provides programmatic configuration via a global object for complex setups and attribute-based configuration for simple HTML implementations. The architecture allows for custom verification handlers and supports various proof-of-work algorithms to increase the cost of attacks for automated scripts and bot farms. It includes a suite of built-in themes and CSS custom property support for visual customization.

Integration is handled via npm or direct script loading, with starter templates available for various frameworks. The software is engineered to be compatible with global privacy regulations including GDPR, HIPAA, CCPA, and LGPD, making it suitable for highly regulated industries.

ALTCHA is a privacy-first security tool for GDPR and HIPAA compliant environments.