mCaptcha

mCaptcha is an open-source, self-hosted bot protection system. It provides a bot protection system that replaces traditional image-solving tasks with a proof-of-work mechanism to prevent spam and mitigate DDoS attacks. The software is deployed as a server and integrated into websites via a client-side widget, allowing site owners to maintain control over their security infrastructure without relying on external proprietary providers.

The system operates by requiring the user's browser to perform SHA256 based computations before a request is processed. This process is automated for the user, who only needs to click a button to initiate the verification. The server validates the resulting proof and issues a token that the target website verifies before processing form submissions or requests. By making interactions computationally expensive for the client, the system ensures that automated bots must expend significant resources to send requests, while legitimate users experience only a slight delay.

Key features

• SHA256 based proof-of-work for rate limiting
• Cookie-free routes to prevent user tracking
• Variable PoW difficulty based on server load
• Protection against replay attacks via short-lived configurations
• IP address independent verification for users behind NAT
• Single-click user interface for verification
• Docker Compose support for self-hosted deployment

Built with Rust and the Actix-web framework, mCaptcha is designed for administrators who want to protect their infrastructure without relying on third-party tracking services. The architecture focuses on privacy by avoiding the collection of user data and eliminating the need for mental bandwidth spent on solving puzzles. It is particularly useful for services that face high volumes of automated traffic but wish to avoid the intrusive nature of traditional CAPTCHAs. The server can be deployed on lightweight hardware, such as a Raspberry Pi, making it accessible for small scale projects and large deployments alike.

It serves as a privacy-focused utility for those seeking to remove image-based challenges from their user experience while maintaining a strong defense against automated abuse.