A self-hosted Google reCAPTCHA alternative (we ship it)

Description and use

Altcha is a self‑hosted, open‑source captcha that runs on your own domain, avoids sending data to US third‑party services, and eliminates GDPR compliance burdens. It uses a proof‑of‑work challenge that takes about one second and replaces behavioral fingerprinting with a cost‑based deterrent.

Problem

EU businesses need a captcha that avoids sending data to US third‑party services and complies with GDPR, while still protecting low‑to‑moderate traffic forms from bots.

Outcome

Altcha reduced client‑side bundle size from 300 KB to 34 KB, eliminated cross‑border data transfers, removed GDPR compliance burden, and provided a one‑second proof‑of‑work challenge that deters low‑to‑moderate traffic bot attacks.

Workflow

• Add two endpoints to backend: /api/altcha/challenge and /api/altcha/verify
• Generate HMAC key (openssl rand -hex 32) and store in env variable
• Serve Altcha widget JS from own domain
• Set Cache‑Control: no‑store on challenge endpoint to prevent CDN caching
• Implement replay protection using Redis SETNX with TTL
• Deploy Altcha on existing backend (FastAPI, Django, etc.)
• Test form submission flow and monitor challenge usage

Evidence

Altcha replaces the "score-the-user" model with a "make-the-bot-pay" model. Proof of work.

Source

The CDN was caching responses from GET /api/altcha/challenge, causing "captcha already used" errors.

Source

Altcha is MIT‑licensed open source. The cost is the CPU spent on the verifying server (negligible) and the client‑side compute (about a second of one core, once per submission).

Source