Self-host PrivateCaptcha
v1.46.1Privacy-first Proof-of-Work CAPTCHA service
- Stars
- 199
- RAM
- 2GB
- Port
- 8080 (HTTP server (portal, API, CDN))
- Requires
- ClickHouse, PostgreSQL
ghcr.io/privatecaptcha/privatecaptcha
What is PrivateCaptcha?
An independent CAPTCHA service built on Proof-of-Work cryptographic challenges that run silently in the background, replacing traditional puzzle-based CAPTCHAs. The self-hosted version deploys via Docker Compose with PostgreSQL and ClickHouse, exposing a lightweight widget (roughly 7% the size of reCAPTCHA) that supports invisible operation, light/dark themes, and over ten languages. Core capabilities include adaptive difficulty that scales exponentially to deter bots, custom rules for targeting specific traffic patterns, a form proxy to shield webhooks, audit trails, a platform API for automation, and detailed usage analytics. The community edition is free for non-commercial use under the PolyForm Noncommercial License; commercial deployments require a paid license. Ready-made integrations cover WordPress, Magento 2, TYPO3, React, Vue, Python, Go, PHP, Java, .NET, Ruby, JavaScript, and OpenAPI.
Should you self-host PrivateCaptcha?
PrivateCaptcha scores 43/100 on selfhost.directory (how scoring works) and ranks #59 of 78 in Security. It has 199 GitHub stars.
It shipped 17 stable releases in the past year. The latest, v1.46.1, came out on 20 October 2026. New versions land roughly every 7 days.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is Other-licensed and written mostly in Go.
Its closest alternative on selfhost.directory is capjs (72/100, 8 197 stars). It scores higher overall, so compare the two before you pick. See PrivateCaptcha vs capjs side by side.
Features
- Adaptive difficulty scaling
- Audit LogsEnterprise edition only in self-hosted
- Custom difficulty rulesEnterprise edition only in self-hosted
- Form proxy
- GDPR Compliance
- Invisible CAPTCHA mode
- Multi-organization SupportEnterprise edition only in self-hosted
- Platform APIEnterprise edition only in self-hosted
- Proof-of-work CAPTCHA
- Rate Limiting
- reCAPTCHA migration compatibility
- Scraping protection
- Two-factor authentication
- Usage statistics
- Widget customization
PrivateCaptcha README
FAQ
Is support included?
Email support during business hours is included with Enterprise license only. Additional support services are billed separately.
Can I run multiple instances with a single license?
One license allows for a single installation of Private Captcha.
What constitutes commercial use?
Commercial use is when client integrations are used by for-profit legal entities or on websites that sell products or services.
Is scraping protection included with any plan?
Yes, scraping protection is included and billed by the number of requests.
How easy is it to migrate from other providers?
Pre-built integrations for different platforms, OpenAPI spec, and a special compatibility mode for reCAPTCHA migration make migration easy.
Is there an additional charge for traffic spikes?
No automatic charges for traffic spikes. Only after monthly usage exceeds the tier limit for two months will support contact you about upgrading.
Can I try Private Captcha before buying?
Yes, there is a 14-day free trial without a credit card.
What counts as a request?
A request refers to obtaining a new puzzle from the servers by the captcha widget or verifying a captcha solution. The widget only obtains a new puzzle when the user starts filling out the form, not on every page load.
More in Authentication
pwmPWM is a self-hosted, open-source password self-service app for LDAP directories. Users reset passwords, unlock accounts, and manage credentials via web UI.
qauthQAuth is a self-hosted, open-source OAuth 2.1/OIDC 1.0 server for AI agents with on-behalf-of delegation, audience-bound tokens, and post-quantum ready crypto.
rauthyOpen-source, self-hosted Rust identity provider: single sign-on for apps and Linux hosts via OIDC, OAuth 2 and PAM, with passkey-first MFA, HA mode and an admin UI.
registryoRegistryo is a self-hosted web UI and token auth server for private Docker Registry v2, with repository browsing, user management, and password recovery.
stack-authSelf-hosted open-source user platform for SaaS apps: auth with passkeys, teams and RBAC, API keys, payments, emails, webhooks, and product analytics with replays.
Stalwart Mail ServerSelf-hosted, open-source Rust mail server with calendars, contacts and shared files over JMAP, IMAP, POP3, SMTP and the DAV protocols, plus built-in anti-spam.
supabaseSelf-hosted open-source Postgres platform with database, auth, realtime, storage, edge functions, and vector embeddings as a Firebase alternative.
supabase-automated-self-hostA bash script that automates deploying Supabase with Nginx or Caddy reverse proxy, Let's Encrypt SSL, and optional Authelia 2FA on Linux using Docker Compose.
supertokensSelf-hosted, open-source authentication service replacing Auth0, Firebase Auth or AWS Cognito, with passwordless, social, email-password login and session management.
systemprompt-templateSelf-hosted AI governance gateway between AI clients, models, and tools with policy enforcement, audit logging, and extensible Rust runtime.
TeleportSelf-hosted open-source platform replacing VPNs with short-lived certificates, SSO, MFA, RBAC, and session audit across SSH, Kubernetes, databases, and web apps.
tesseralTesseral is a self-hosted, open-source auth platform for B2B SaaS with multi-tenant login, SAML/OIDC/SCIM, RBAC, MFA, passkeys, API keys, and audit logs.
0 comments