AllBugsFeaturesChangelogSearchNew post
Sign in with Fluxer
Features

Use Cap instead of hCAPTCHA (for the flagship instance)

(#1287) Feature Shipped privacy security
by RexSystem edited originally by @litekin on GitHub

Problem

hCAPTCHA is a third-party, closed-source, user intrusive, and expensive CAPTCHA widget.

Proposal

Cap seems like a better option. It is a self-hosted, open-source, proof of work, lightweight CAPTCHA widget. Feature table: https://trycap.dev/guide/alternatives Full comparison with hCAPTCHA: https://trycap.dev/guide/alternatives/hcaptcha Demo: https://trycap.dev/guide/demo.html More info: https://trycap.dev/guide/effectiveness.html

Notes

2026-07-01_20-35
  • 617922084-cbde7243-1e3b-49a5-b756-39b99c7fcc85.png

    617922084-cbde7243-1e3b-49a5-b756-39b99c7fcc85.png

    785×600 | 34 kB

12 comments

Sign in with Fluxer to comment and vote.
Comment by @notrevenant
RexSystem 1 vote originally by @notrevenant on GitHub 7 replies
I'm personally aware of Cap, but I'm wondering about its track record. Are there any known enterprises/businesses relying on it?
Permalink
Comment by @litekin
RexSystem 1 vote originally by @litekin on GitHub OP
I only know of small personal sites but yeah with "only" 7k stars it's still relatively unpopular edit: see below comment (Adguard, Bunny, Fraunhofer)
Permalink
Comment by @MrRubberDucky
RexSystem 1 vote originally by @MrRubberDucky on GitHub
GitHub stars aren't an accurate metric of popularity tbh. It's like Facebook likes back in the day, you can get a lot of them but only have 3 people know about your product. Judging by their site (https://trycap.dev/), Adguard (for their temp mail product), Bunny (EU CDN, see them as yuropean Cloudflare alternative) and Fraunhofer (German research organization) all use some form of Cap, be it heavily modified or not so there is/was some big companies reliance. I would bet it would be more but companies don't usually publicly endorse things out of their goodwill, they yoink and think later.
Permalink
Comment by @litekin
RexSystem 1 vote originally by @litekin on GitHub OP
Good points, thanks. idk how I forgot about the brands listed on their site lol. On GitHub stars, I think an unpopular thing can have lots of stars but a popular thing usually does have lots of stars. So I'm saying it can't be too popular relative to other captchas.
Permalink
Comment by @notrevenant
RexSystem 1 vote originally by @notrevenant on GitHub
In any case, it still could be a nice addition.
Permalink
Comment by @rhyses-pieces
RexSystem 1 vote originally by @rhyses-pieces on GitHub
Speaking as an end-user and as someone who cares about accessibility: I'm bad at visual puzzles. Sometimes, hCaptcha's puzzles are so visually distorted that I genuinely can't solve them. They're also inaccessible to those who might be using screen readers, visually impaired, or have motor issues. IMO, switching to any captcha solution that's based on PoW challenges lowers the barrier of entry to the app. I would suppose the problem lies in the cost of switching over, how that might affect existing users, etc. In any case, it should be painless for end-users to use or, better yet, none of their concern, since a captcha solution's main priority is keeping bots out.
Permalink
Comment by Hampus
HampusStaff 1 vote originally by @hampus-fluxer on GitHub
We went with ALTCHA in the end, the open-source proof-of-work captcha suggested further up, rather than Cap. It replaced hCaptcha entirely as of #3035 (after trialling it in #2986), on fluxer.app and on self-hosted instances alike. Challenges are issued and verified by our own API, so there's no third-party captcha service involved and no visual puzzle to solve. The browser just does a short proof-of-work in the background, which should also help with the accessibility concerns raised here.
Permalink