# mCaptcha/mCaptcha

A no-nonsense CAPTCHA system with seamless UX | Backend component

Repository: https://github.com/mCaptcha/mCaptcha
Canonical: https://ross.abutalabs.com/products/mcaptcha
Homepage: https://demo.mcaptcha.org
Language: Rust
License: AGPL-3.0
License Family: copyleft
Topics: mcaptcha, captcha, proof-of-work, privacy, self-hosted, rust, actix-web, spam-protection, ddos-protection, ddos-mitigation, self-host
Last push: 2025-10-07T08:47:27+00:00

## Health v2 (maintenance only)
Score: 43/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 45, release rhythm 8, longevity 100
- inputs: {"age_days": 2003, "days_push": 330, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2486, forks 94 (observed 2026-08-28T04:06:55.585128+00:00)

## What it is
mCaptcha is a self-hosted, privacy-respecting CAPTCHA system that uses SHA-256 proof-of-work to rate-limit users instead of image puzzles. This repository is the backend service that validates proofs of work and issues tokens for websites to verify.

## Use cases
- protect a website form from spam bots without annoying image CAPTCHAs
- mitigate DDoS attacks by making requests computationally expensive for clients
- replace Google reCAPTCHA with a self-hosted, tracking-free alternative
- add bot protection to a login or signup flow with seamless UX
- rate limit abusive traffic using variable proof-of-work difficulty

## When to choose
- you need a privacy-focused CAPTCHA with no user tracking
- you want to self-host your bot protection instead of relying on third parties
- you prioritize seamless UX over interactive puzzles
- you need DDoS mitigation that scales difficulty with attack load

## When to avoid
- you need accessibility features for users on low-powered devices where PoW computation is slow
- you prefer a managed SaaS CAPTCHA with zero infrastructure
- you need a CAPTCHA that blocks fully automated headless browsers with high compute resources

## Facets
- artifact type: service
- maturity: active
- function: security, rate-limiting, http-server, web-framework, self-hosted
- domain: security, web-development, privacy, self-hosted
- platform: self-hosted, rust
- tags: captcha, proof-of-work, anti-spam, ddos-protection, bot-protection, privacy-respecting, actix-web, linux, docker, web-server

## Member repositories
- mCaptcha/mCaptcha (main) score 43

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:55.585128+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:28:02.638348+00:00, confidence not recorded.
  - readme: https://github.com/mCaptcha/mCaptcha (fetched 2026-08-28T04:06:55.585128+00:00, sha f3222cc9f1fc)
  - homepage: https://demo.mcaptcha.org (fetched 2026-08-29T10:09:54.737488+00:00, sha e9ea0018ae04)
  - site_page: https://mcaptcha.org/about (fetched 2026-08-29T10:09:54.746288+00:00, sha 096e5a03c152)
- Data as of 2026-08-30T08:39:29.467469+00:00.