Cap

Cap is an open-source, self-hosted CAPTCHA platform that provides bot protection and anti-spam defense by replacing traditional visual puzzles with proof-of-work and instrumentation challenges. The software is designed to prevent automated abuse and scraping while remaining accessible to human users without requiring them to solve tedious image-based tasks.

The software is deployed as a web application, typically via a standalone Docker container. It integrates into websites through a lightweight JavaScript implementation, allowing administrators to manage their own bot defense infrastructure. Because it is self-hosted, the system does not rely on external proprietary clouds to validate human presence, ensuring that the verification process remains under the control of the site owner.

Key features

• SHA-256 proof-of-work challenges
• Zero telemetry and privacy-focused design
• Standalone deployment via Docker container
• CSS variable customization for colors, size, and icons
• Background challenge solving without user interaction
• Small footprint of approximately 20kb
• Zero external dependencies

Cap is built using Bun and JavaScript, prioritizing speed and minimal resource consumption. The architecture utilizes Hashcash-style proof-of-work, which requires the client to perform a computational task before a request is accepted. This approach removes the need for users to interact with the interface entirely, as the widget can be hidden and the challenges solved in the background. This makes it a practical choice for developers who need to protect forms, login pages, or APIs from automated scripts without introducing heavy dependencies or tracking scripts that slow down page load times.

Cap serves as a privacy-preserving tool for site administrators who want to mitigate bot traffic and prevent scraping without compromising user data or relying on third party telemetry.