2.7k stars · MIT · v3.2.2 (2026-08-19)
The invisible little box in front of every form, and Google is not reading the room.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A self-hosted CAPTCHA replacement using proof-of-work. Instead of "click all the traffic lights," the visitor's browser silently solves a small computation. GDPR-safe, WCAG 2.2 AA, no third-party tracking, no cookies.
Why it matters
Every form on Grasppy (Typebot, Listmonk signup, contact) will get bot-submitted the moment it exists. The default is reCAPTCHA, which sells the visit to Google — a bad trade for a founder who wants European trust and a good geo-optimizer-skill score (Ed.8 #3). Altcha is small, invisible in normal use, works client-side, and is exactly the kind of privacy-by-default detail that makes the "trust" story credible without a footnote.
- MIT, tiny library (about 30 kB of JavaScript)
- No third-party dependency — GDPR/EAA compliant with no cookie notice change
- Handles both the browser widget and the server-side verification
- Proof-of-work makes the visitor's phone do ~100ms of work per submit — negligible on new phones, real on very old ones
- Does not stop determined bots; it makes cheap spam expensive
- Server-side rate limiting is still your job — Altcha is not a WAF
reCAPTCHA and hCaptcha — and the visitor data they collect
Typebot forms, Listmonk signup, and any contact form on the site
FastAPI verifies the token; the React shell embeds the widget.