Checkbox, floating or invisible
Show the checkbox, hide it until a button is pressed, or solve in the background from your own code.
The CAPTCHA you host yourself. Bots and AI agents out, people in.
Cap stops scrapers, AI agents and headless browsers with proof-of-work and browser checks. Nobody clicks on buses, and nothing goes to Google.
- agent via Playwright · webdriver_true · blocked
- Firefox 147 on Linux · 1.9 s · passed
- puppeteer-extra-stealth · webdriver_stripped · blocked
- python-requests · no token · rejected
- Safari on iPhone · 2.4 s · passed
- Camoufox · geometry_quantized · blocked
- chrome-headless-shell · chrome_object_missing · blocked
- Canvas Blocker extension · native_tamper · harder puzzle
- HeadlessChrome/142 · headless_token · blocked
- Brave on Windows · 2.1 s · passed
- Selenium + Firefox · webdriver_true · blocked
- curl/8.11 · no token · rejected
- Playwright Firefox · juggler_package · blocked
- Chrome on Android · 3.2 s · passed
- spoofed UA, real one in worker · worker_mismatch · blocked
- LibreWolf · 2.0 s · passed
- CDP viewport override · window_exceeds_screen · blocked
- ungoogled-chromium · 1.8 s · passed
- Firefox via Marionette · webdriver_true · blocked
- Firefox faking Chrome APIs · gecko_contradiction · blocked
- Vivaldi on macOS · 1.7 s · passed
- Go-http-client · no token · rejected
- Firefox on Android · 3.0 s · passed
- GPTBot · no token · rejected
- Opera on Windows · 2.2 s · passed
- node-fetch · no token · rejected
- CDP device emulation · viewport_override · blocked
- Samsung Internet · 2.8 s · passed
- curl · rejected
- Firefox · passed
- Scrapy · rejected
- Safari · passed
- Selenium · blocked
- wget · rejected
- Edge · passed
- Puppeteer · blocked
- httpx · rejected
- Vivaldi · passed
- aiohttp · rejected
- Opera · passed
- Deno fetch · rejected
- Brave · passed
- lynx · rejected
- Chromium · passed
- Go-colly · rejected
- Arc · passed
- Nightmare · blocked
- Zen · passed
jsDelivr served 4,695,114,711 Cap requests in the past year.
Catches the browsers agents drive
Most abuse now comes from automated browsers, not curl. Turn on browser checks and Cap tests for Playwright, Puppeteer, Selenium, Camoufox and stealth plugins. The verdict happens on your server, so a patched browser can't vouch for itself.
How detection worksWhat your server gets back from a bot
{
"success": false,
"reason": "instr_automated_browser",
"blockedBy": [
"webdriver_true",
"headless_token"
]
}webdriver_truewebdriver_strippedheadless_tokenchrome_object_missinggeometry_quantizedjuggler_packagegecko_contradictionwindow_exceeds_screenviewport_overrideworker_mismatch
Your traffic, on your server
Standalone comes with a dashboard for every site key. It shows challenges, solves and failures over time, where they come from and which networks they use. Country and network lookups run against a database on your own server.
- Settings per site key
- Set the difficulty, browser checks and rate limits separately for each site.
- Blocked IPs
- Block an address or a range from the dashboard when something gets through.
- One Docker container
- Standalone runs as a single image next to Redis or Valkey.
The rest of the toolbox
Everything here ships in the open-source release. There is no paid tier holding features back.
Proof-of-work GPUs can't skip
HashWX builds a new hash function for every challenge, so a GPU solves it about 2x faster than a CPU instead of 150x.
HashWXRate limits
Cap how many challenges one IP can ask for in a window, for the whole instance or one site key.
No cookies, no tracking
Nothing goes to a third party, so the privacy review is short in most jurisdictions.
ComplianceAbout 20 kB
The widget weighs about 20 kB minified and gzipped. reCAPTCHA weighs about 500 kB.
Any backend
Verify a token with one POST to /siteverify from any language. The response matches reCAPTCHA's.
Cap has been a good fit for AdGuard Temp Mail. We use it as an invisible, self-hosted CAPTCHA layer with proof-of-work and browser instrumentation challenges, which helps us add abuse protection while keeping the experience lightweight and unobtrusive for regular users.
Head of PR, AdGuardQuestions
More answers in the docsDoes it stop AI scrapers?
Yes. Cap blocks the automated browsers most AI agents browse with, and plain HTTP scrapers can't run the challenge, so they never get a token.
Is it GDPR-friendly?
Yes. Cap doesn't phone home, doesn't set cookies, and doesn't fingerprint users. Your server sees the verification, no one else does.
Can I migrate from reCAPTCHA or hCaptcha?
Yes. Cap's siteverify API is compatible with reCAPTCHA and hCaptcha, but you'll need to swap your client-side code to use Cap's widget.
What does it cost to self-host?
Cap Standalone fits on a $5 VPS for most sites. There are no per-request fees, no egress to a third party, and no API quotas to hit.
What is an open-source CAPTCHA?
An open-source CAPTCHA is bot protection whose code you can read, audit, and self-host, rather than a closed third-party service. Cap is licensed under Apache 2.0 and runs entirely on your own infrastructure, so visitor data never reaches a vendor.
Add it to a form this afternoon.
Run one Docker container, create a site key, and drop the widget into your form.
<script src="https://cdn.jsdelivr.net/npm/@cap.js/widget"></script>
<form action="/signup" method="POST">
<input name="email" />
<cap-widget
data-cap-api-endpoint="https://cap.example.com/<site-key>/"
></cap-widget>
<button>Sign up</button>
</form>