What is FCaptcha?

FCaptcha is a self-hosted CAPTCHA system that detects bots, headless browsers, automation frameworks, and vision-based AI agents such as GPT-4V and Claude Computer Use. It uses behavioral biometrics (mouse micro-tremor, keystroke cadence, touch kinematics), environmental fingerprinting (Playwright, Puppeteer, Selenium detection, CDP artifacts, TLS JA3/JA4), and server-verified SHA-256 proof-of-work challenges. The widget offers checkbox or invisible modes and serves drop-in compatible siteverify endpoints for Turnstile, reCAPTCHA, and hCaptcha so migration is a base-URL change. It runs as a single container (Go, Python, or Node.js) with optional Redis for multi-replica state sharing. No cookies, no third-party data, no persistent fingerprinting. Licensed MIT.

Should you self-host FCaptcha?

FCaptcha scores 50/100 on selfhost.directory (how scoring works) and ranks #42 of 78 in Security. It has 227 GitHub stars.

It shipped 21 stable releases in the past year. The latest, v1.46.1, came out on 21 October 2026. New versions land roughly every 6 days.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in JavaScript.

Its closest alternative on selfhost.directory is capjs (72/100, 8 197 stars). It scores higher overall, so compare the two before you pick. See FCaptcha vs capjs side by side.

How to configure FCaptcha

FCAPTCHA_ALLOWED_HOSTNAMESComma-separated hostnames permitted to mint tokens, matched against request Origin then Referer; unset accepts any origin
Comma-separated hostnames permitted to mint tokens, matched against request Origin then Referer; unset accepts any origin
values: comma-separated hostnames
FCAPTCHA_CLIENT_PATHauto-probedExplicit path to client/fcaptcha.js for same-origin widget serving
Explicit path to client/fcaptcha.js for same-origin widget serving
values: absolute path
FCAPTCHA_EXPERIMENTAL_BLOCKINGOpt into blocking mode for experimental checks; must match shipped policy name
Opt into blocking mode for experimental checks; must match shipped policy name
values: policy name (e.g. stealth-corroboration-v1)
FCAPTCHA_INSECURE_DEV_MODEoffExplicitly use the public development signing key; local-only, never expose a server with this enabled
Explicitly use the public development signing key; local-only, never expose a server with this enabled
values: on/off
FCAPTCHA_LOG_VERDICTSEnable verdict logging including experimental observations
Enable verdict logging including experimental observations
values: on/off
FCAPTCHA_MAX_SITE_KEYS_PER_IPDistinct site keys one IP may allocate state for before excess is folded into overflow bucket
Distinct site keys one IP may allocate state for before excess is folded into overflow bucket
values: integer
FCAPTCHA_SECRETSecret key for token signing (required, generate with openssl rand -hex 32)
Secret key for token signing (required, generate with openssl rand -hex 32)
values: 32+ byte hex string
FCAPTCHA_SERVE_CLIENTtrue(Python) Serve the widget at /fcaptcha.js; set false to host client on separate CDN
(Python) Serve the widget at /fcaptcha.js; set false to host client on separate CDN
values: true/false
FCAPTCHA_SITE_KEYSComma-separated allowlist of accepted site keys; unset accepts any key
Comma-separated allowlist of accepted site keys; unset accepts any key
values: comma-separated keys
FCAPTCHA_TLS_CERTServe HTTPS directly (Go server); enables native JA4 TLS fingerprinting
Serve HTTPS directly (Go server); enables native JA4 TLS fingerprinting
values: path to cert file
FCAPTCHA_TLS_KEYServe HTTPS directly (Go server); enables native JA4 TLS fingerprinting
Serve HTTPS directly (Go server); enables native JA4 TLS fingerprinting
values: path to key file
FCAPTCHA_VERIFY_SECRETFCAPTCHA_SECRETCredential backend presents to /api/token/verify and siteverify endpoints; defaults to FCAPTCHA_SECRET
Credential backend presents to /api/token/verify and siteverify endpoints; defaults to FCAPTCHA_SECRET
values: 32+ byte hex string
PORT3000Server port
Server port
values: 1-65535
REDIS_URLRedis URL for shared security state across replicas; fail-closed if configured Redis unavailable
Redis URL for shared security state across replicas; fail-closed if configured Redis unavailable
values: redis://...
TRUSTED_JA4_HEADERSReverse-proxy header names carrying a JA4 TLS fingerprint; only read from peers in TRUSTED_PROXIES
Reverse-proxy header names carrying a JA4 TLS fingerprint; only read from peers in TRUSTED_PROXIES
values: header names
TRUSTED_PROXIESloopback + private rangesComma-separated CIDRs/IPs of peers allowed to set X-Forwarded-For, X-Real-IP and TLS-fingerprint headers; defaults to loopback + private ranges
Comma-separated CIDRs/IPs of peers allowed to set X-Forwarded-For, X-Real-IP and TLS-fingerprint headers; defaults to loopback + private ranges
values: CIDR list or * or none

FAQ

What does proof of work mean for CAPTCHA security?

Proof of work requires visitors to complete SHA-256 cryptographic challenges before submission, forcing bots to spend real compute resources per request. Humans experience a brief delay (typically under 500ms), while botnets face significant CPU costs. Combined with behavioral analysis, it creates defense-in-depth.

Can I self-host FCaptcha without external API calls?

Yes. FCaptcha is designed for complete self-hosting with no external dependencies. Choose from server implementations in Go, Python, or Node.js. All verification happens on your infrastructure with no data sent to third parties.

What is vision AI detection and why does it matter?

Vision AI detection identifies bots that take screenshots of CAPTCHA challenges, send them to vision APIs like GPT-4V or Claude, and use returned coordinates to click. FCaptcha detects this via timing signatures, interaction entropy, and behavioral inconsistencies that distinguish human solving from API-driven automation.

How is FCaptcha different from reCAPTCHA or Cloudflare Turnstile?

FCaptcha is fully open source with auditable scoring algorithms, runs self-hosted with no external dependencies or data sharing, and specifically detects vision-based AI agents that can solve traditional CAPTCHAs. Unlike reCAPTCHA and Turnstile, it keeps all data on your servers with no persistent fingerprinting or cross-site tracking.

What is FCaptcha and how does it detect bots?

FCaptcha is an open-source CAPTCHA system that detects bots through multiple verification layers: vision AI detection for screenshot-to-API automation, SHA-256 proof of work with server-side timing validation, keystroke cadence biometrics analyzing 7 typing metrics, and 50+ behavioral signals including mouse micro-tremor analysis and Playwright detection.