Cap Self-hosted CAPTCHA
for the modern web.
No Google. No telemetry. No visual puzzles.
Switch from reCAPTCHA in minutes.
250x smaller than hCaptcha.
No puzzles, no tracking.
Privacy-first
Zero telemetry. No third-party network. Your users' data stays between you and them.
~20kb, zero dependencies
Loads in milliseconds, not seconds.
No visual puzzles
PoW and instrumentation run silently in the background. No "click the traffic lights."
Apache 2.0
Free forever. Audit it, fork it, own it. No vendor can pull the rug.
Standalone mode
Deploy anywhere with one Docker container. Includes analytics and multi-site-key support.
Programmatic
Hide the widget entirely and solve challenges silently, ideal for APIs and forms.
API protection
Block abusive traffic while allow-listing trusted automated clients.
Fully customizable
Colors, size, position, icons, all controllable via CSS variables. No iframe lock-in.
How it compares.
Cap sits in the same detection tier as the big names, without shipping your users' data to a third party.
| Cap | reCAPTCHA | Turnstile | hCaptcha | Friendly | |
|---|---|---|---|---|---|
| Self-hosted | Yes | - | - | - | - |
| Open source | Apache 2.0 | No | No | No | No |
| No visual puzzles | Yes | Frequent | Yes | Frequent | Yes |
| No 3rd-party telemetry | Yes | Cloudflare | hCaptcha | Limited | |
| Bundle size | ~20 kb | 500 kb+ | 110 kb+ | 600 kb+ | 80 kb+ |
| Free at scale | Yes | Quota | Yes | Quota | Paid |
| Instrumentation layer | Yes | Yes | Yes | Yes | No |
Two independent layers.
Bypass one, the other still holds.
Every challenge solves proof-of-work and runs browser instrumentation at the same time. Defeating one layer doesn't defeat the other.
Heavy math, in the browser.
The client solves parallel SHA-256 hashes in WASM. Tuned against GPU acceleration, real CPU time, real money to scale.
sha256A real browser proves itself.
A freshly-generated JS program runs DOM-dependent ops a real browser handles trivially, and a headless runtime cannot fake cheaply.
domDrop it in. Point at your server.
Verify server-side.
- Is it GDPR-friendly?
- Yes. Cap doesn't phone home, doesn't set cookies, and doesn't fingerprint users. Your server sees the verification, no one else does.
- Can I migrate from reCAPTCHA / hCaptcha?
- Yes. Cap's siteverify API is compatible with reCAPTCHA and hCaptcha, but you'll need to swap your client-side code to use Cap's widget.
- How effective is it against real bots?
- Cap's instrumentation combined with proof-of-work is very effective at making abuse extremely difficult to automate at scale.
- What does it cost to self-host?
- Cap Standalone fits on a $5 VPS for most sites. There are no per-request fees, no egress to a third party, and no API quotas to hit.
Ship Cap in 15 minutes.
Drop the widget into your site, point it at a $5 VPS, and stop paying anyone to see your users' traffic.