# mCaptcha

Proof-of-work CAPTCHA system with a client widget and a server that validates the tokens a site receives.


Source: https://findsoftware.frbit.cloud/mcaptcha/
Last reviewed: 2026-11-03
Listed since: 2026-11-03

## Record

### Links

- home: https://mcaptcha.org
- repository: https://github.com/mCaptcha/mCaptcha
- docs: https://mcaptcha.org/docs/webmasters/installing-captcha/
- x: https://twitter.com/m_captcha/
- mastodon: https://gts.batsense.net/@mcaptcha

### Identity

- status: active
- maintainer: Aravinth Manivannan
- maintainerType: unknown
- parent: unknown
- firstRelease: 2024
- hqCountry: unknown

### Kind

- category: forms
- hosting: binary
- language: rust
- runtime: binary
- runtimeMin: unknown
- basedOn: unknown

### Content

- contentStore: not applicable
- databases: postgres, mariadb
- adminUi: yes
- headlessApi: not applicable
- templating: not applicable
- i18n: not applicable

### Rendering and deploy

- runsAs: always-on
- renderingModes: not applicable
- installMethod: docker-compose

### License

- licenseModel: open-source
- license: AGPL-3.0

### Releases

- currentMajor: 0
- latestReleaseDate: 2024-03-15

### Adoption

- githubStargazers: 2498
- packagistDownloads: not applicable
- npmWeeklyDownloads: not applicable
- contributors: 17
- pluginCount: unknown
- packagistMonthlyDownloads: unknown
- ecosystemsMonthlyDownloads: unknown
- httpArchiveSites: unknown
- wordpressActiveInstalls: unknown
- dependentRepos: unknown
- dependentPackages: unknown

### Sources

- urls: https://mcaptcha.org/ (read 2026-11-03)
- urls: https://api.github.com/repos/mCaptcha/mCaptcha (read 2026-11-03)
- urls: https://mcaptcha.org/docs/webmasters/installing-captcha/ (read 2026-11-03)
- maintainer: https://raw.githubusercontent.com/mCaptcha/mCaptcha/master/docker-compose.yml (read 2026-11-03)
- language: https://api.github.com/repos/mCaptcha/mCaptcha (read 2026-11-03)
- category: https://mcaptcha.org/ (read 2026-11-03)
- runtime: https://raw.githubusercontent.com/mCaptcha/mCaptcha/master/docs/DEPLOYMENT.md (read 2026-11-03)
- installMethod: https://github.com/mCaptcha/mCaptcha/blob/master/README.md (read 2026-11-03)
- installMethod: https://mcaptcha.org/docs/self-hosting/docker/ (read 2026-11-03)
- installMethod: https://mcaptcha.org/docs/self-hosting/bare-metal/ (read 2026-11-03)
- installMethod: https://mcaptcha.org/docs/self-hosting/bare-metal/ (read 2026-11-03)
- installMethod: https://mcaptcha.org/docs/self-hosting/ansible/ (read 2026-11-03)
- runsAs: https://mcaptcha.org/docs/self-hosting/bare-metal/ (read 2026-11-03)
- databases: https://mcaptcha.org/docs/self-hosting/bare-metal/ (read 2026-11-03)
- databases: https://mcaptcha.org/docs/self-hosting/bare-metal/ (read 2026-11-03)
- adminUi: https://mcaptcha.org/docs/webmasters/installing-captcha/ (read 2026-11-03)
- license: https://api.github.com/repos/mCaptcha/mCaptcha (read 2026-11-03)
- licenseModel: https://raw.githubusercontent.com/mCaptcha/mCaptcha/master/LICENSE.md (read 2026-11-03)
- firstRelease: https://api.github.com/repos/mCaptcha/mCaptcha/releases (read 2026-11-03)
- currentMajor: https://api.github.com/repos/mCaptcha/mCaptcha/releases (read 2026-11-03)
- latestReleaseDate: https://api.github.com/repos/mCaptcha/mCaptcha/releases (read 2026-11-03)
- githubStargazers: https://api.github.com/repos/mCaptcha/mCaptcha (read 2026-11-03)
- contributors: https://api.github.com/repos/mCaptcha/mCaptcha/contributors (read 2026-11-03)

## Notes

mCaptcha is a CAPTCHA server that protects forms with a proof-of-work challenge instead of puzzles. The visitor's browser computes a SHA256 proof of work through a widget the site loads from a CDN or serves itself. The site's backend then sends the resulting token to the mCaptcha server's verification endpoint before it processes the form.

The server is a Rust binary that the [bare-metal guide](https://mcaptcha.org/docs/self-hosting/bare-metal/) runs as a systemd service, with Postgres or MariaDB for its data. An optional Redis cache can sit beside it, and the project says mCaptcha does not implement SSL, so a reverse proxy goes in front. Site keys are created in a dashboard, and the [installation guide](https://mcaptcha.org/docs/webmasters/installing-captcha/) walks through the widget and the verification call. The project says its CAPTCHA routes are cookie free and that it does not use IP addresses for rate limiting.

## Worth knowing

The README says the project has no stable release yet, although GitHub lists a v0.1.0 release.

---

Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attributes are recorded, never scored; absent means unknown.
Credit, in full: FindSoftware, CC BY 4.0