WHAT IS IT?
mCaptcha is a self-hosted CAPTCHA system that replaces image grids with proof-of-work: the visitor's browser solves a SHA256 computation in the background and the server validates the proof. For the user it all comes down to clicking a checkbox; for a bot, every request carries a computational cost that makes mass spam prohibitively expensive.
WHY IS IT INTERESTING?
- Zero friction: no crosswalks to identify, no distorted text to decipher. The computation is invisible and the user only clicks.
- Adaptive difficulty: imperceptible under normal traffic, the proof climbs to roughly two seconds of computation under attack. Attacking the site costs more than absorbing the requests.
- Privacy by design: no cookies, no profiling, and rate-limiting does not rely on IP addresses, so users behind a NAT are never penalized.
- reCAPTCHA / hCaptcha drop-in: the APIs are compatible with both services, so migrating does not require rewriting an existing integration.
- Replay-resistant: single-use tokens with a 30-second lifetime, a Rust (Actix-web) server shipped as official Docker images. The core is AGPL, the client libraries use permissive licenses.
USE CASES
- Protect sensitive forms (sign-up, login, contact) without depending on Google.
- Replace reCAPTCHA or hCaptcha on an existing site through the compatible APIs.
- Curb bot spam on a public instance (Git forge, forum, wiki).
- Serve a GDPR-friendly CAPTCHA with no cookies and no data collection to declare.