The CAPTCHA alternative without tracking, without cookies and without picture puzzles. Proof of work and behavioural analysis, processed on our own servers in Germany.
Permanently free for private websites. Pricing for commercial use · Compared with reCAPTCHA
Today: – Verifications · – Bots stopped · in total –
You are being verified …
live · no click needed
Quickstart
How it works
Real humans notice nothing. Bots fail multiple layers at once.
The V2 widget (16 KB) fetches an adaptive challenge policy from the server — difficulty, challenge type and profile are controlled per site and form.
SHA-256 or memory-hard PoW in the WebWorker. In parallel: mouse entropy, typing rhythm and scroll behavior are captured passively — only scores, no raw data.
Context-aware scoring: a login is judged more strictly than a contact form. IP archive, campaign detection, confidence score. Answer in under 50 ms.
What really happens between page load and submit is set out stage by stage on the page How CaptchaCore works.
Multi-layered security
SHA-256 or memory-hard Argon2 (GPU-resistant) — every client has to do computational work. Difficulty is controlled dynamically per site profile and under-attack level. Nonces EdDSA-signed, single-use.
Mouse entropy, typing rhythm, scroll/touch/focus, canvas timing, WebGL renderer, requestAnimationFrame cadence, OfflineAudioContext, storage APIs — exposes even disguised headless browsers (Puppeteer Stealth, Playwright). Privacy by design, scores only.
Context-aware scoring: a login is judged more strictly than a contact form. Site profiles, form policies, confidence score and reason codes. IP reputation, ASN, user agent, environment fingerprint — all weighted per profile.
Extensive IP archive of high-risk addresses, updated several times a day. Automatic campaign detection for coordinated attacks. Auto-learning from blocked patterns with score decay.
4-level Under-Attack-Mode (levels 0–3). Automatic escalation based on block rate. Memory-hard PoW and interaction step-up under elevated risk. HMAC-signed access cookies per level.
The technical and organisational measures behind these layers are listed on the Security page.
Three modes
From invisible protection to the classic checkbox — you decide how much your users see.
Widget visible, the checkbox ticks itself once enough human interaction is detected (typing, mouse, scrolling). No click required. Fallback: users can also click manually.
data-captchacore="interactive"
The checkbox has to be clicked manually. Like the well-known providers, but without their data outflow. Starts the computation on click. Good for forms with high security requirements.
data-captchacore="visible"
No UI. PoW solves entirely in the background. Ideal for login forms or pages where a widget would get in the way. Blocks submit until the token is ready.
data-captchacore="invisible"
Features
Verification, risk engine and database run on our own servers in Germany. On request you can also run CaptchaCore entirely on your own infrastructure.
No cookies, no tracking, no raw data. Rolling-salt IP hashing (6h rotation), separate operational/security logs with strict retention periods.
The risk engine answers in under 50 ms and the computation is solved after roughly 200 ms. The widget weighs 16 KB gzip and, thanks to a web worker, never blocks the interface.
Hashcash principle. Difficulty configurable from 2–6. Single-use nonce via Redis with TTL. A WebWorker solves it in the background.
Mouse, typing rhythm, touch, paste, canvas timing, WebGL renderer, rAF cadence, storage APIs. Detects even disguised headless browsers. Aggregated, no raw data.
4-level Under-Attack-Mode. Automatic escalation and de-escalation. Level-specific access cookies.
Threat Intelligence learns hourly from blocked patterns. IP ranges, UA patterns and behavioral anomalies are detected automatically.
Light, dark or automatic appearance, plus accent colour, label, your own branding and size — configurable per site.
Reports, verification logs, threat picture, site management, key rotation, user management and a complete audit trail.
Integration
WordPress plugin, Laravel package, Symfony bundle or simply a script tag — CaptchaCore adapts to your stack.
<!-- 1. Script einbinden --> <script src="https://src-eu.captchacore.eu/widget/captchacore-v2.min.js" data-service-url="https://api.captchacore.eu" data-site-key="cc_pub_dein_key" async defer></script> <!-- 2. Formular mit data-captchacore Attribut --> <form data-captchacore="interactive" method="post"> <div data-captchacore-widget></div> <button type="submit">Absenden</button> </form> <!-- 3. Server-seitig Token verifizieren --> POST https://api.captchacore.eu/api/v2/verify Header: X-CaptchaCore-Key: cc_sec_dein_secret Body: { "token": "...", "form_type": "contact" }
// 1. Repository in composer.json eintragen "repositories": [{"type":"composer", "url":"https://captchacore.eu/packages"}] // 2. Paket installieren composer require captchacore/laravel // 3. .env konfigurieren CAPTCHACORE_URL=https://api.captchacore.eu CAPTCHACORE_SITE_KEY=cc_pub_dein_key CAPTCHACORE_SECRET_KEY=cc_sec_dein_secret // 3. Blade-Component im Formular <x-captchacore::widget /> // 4. Middleware auf Route Route::post('/register', RegisterController::class) ->middleware('captchacore:register');
// 1. Repository in composer.json eintragen "repositories": [{"type":"composer", "url":"https://captchacore.eu/packages"}] // 2. Bundle installieren composer require captchacore/captchacore-bundle // 3. .env konfigurieren CAPTCHACORE_URL=https://api.captchacore.eu CAPTCHACORE_SITE_KEY=cc_pub_dein_key CAPTCHACORE_SECRET_KEY=cc_sec_dein_secret // 4. FormType im Formular — oder Attribute / Validator / Twig $builder->add('captcha', CaptchaCoreType::class, [ 'form_type' => 'contact', ]); // Alternativ: #[RequiresCaptcha] auf der Controller-Action #[RequiresCaptcha(formType: 'contact')] public function submit(Request $request): Response { /* ... */ }
// 1. Plugin hochladen unter Plugins > Installieren // 2. Unter Einstellungen > CaptchaCore konfigurieren: Service-URL: https://api.captchacore.eu Site Key: cc_pub_dein_key Secret Key: cc_sec_dein_secret // 3. Formulare aktivieren (Checkboxen): ☑ Login ☑ Registrierung ☑ Kommentare ☑ Passwort vergessen ☑ Formidable Forms // Kein Code nötig. Fertig.
Full guides, error codes and reason codes are in the documentation. Plugins and packages are available for download there as well.
Comparison
The three figures that end up in your privacy notice and in your load time. Everything else is set out with sources on the comparison page.
Place of processing
Germany
reCAPTCHA and hCaptcha process data in the USA among other places.
Widget size (gzip)
16 KB
reCAPTCHA loads around 450 KB, hCaptcha around 65 KB.
Picture puzzles
none
At the US providers they appear as soon as a visitor is considered suspicious.
Privacy
The widget talks exclusively to our API in Germany. No Google, no ad network, no tracker. The script file itself comes from the European CDN.
Before storage the last octet of an IPv4 address and the last 80 bits of an IPv6 address are dropped. This cannot be switched off, only tightened.
Default: 30 days. Automatic cleanup via cron. Can be set to 7 or 90 days.
Mouse movement, keystrokes and touch events are condensed inside the browser. Only metrics and hashes leave the device.
Only in Under-Attack-Mode: a short-lived HMAC-signed cookie (30 min). Otherwise: no cookies.
Data minimization as the technical default. Not a feature toggle, but an architectural decision.
Which data is processed for which purpose is set out in the privacy centre. As a customer you conclude the data processing agreement electronically in your account.
Technical details
Current response times and the state of every component are shown on the public system status.
Global infrastructure
A European CDN delivers the widget file. The EU endpoint is the default; you only enable the worldwide endpoint if you need it.
The widget file is delivered exclusively via European servers. No transfer to third countries takes place.
src-eu.captchacore.eu
35 locations in Europe:
Germany (primary), Austria, Switzerland, Netherlands, Belgium, France, United Kingdom, Ireland, Spain, Portugal, Italy, Sweden, Norway, Denmark, Finland, Poland, Czech Republic, Romania, Bulgaria, Greece, Croatia, Serbia, Slovenia, Hungary
All European locations plus servers worldwide, for short load times with an international audience. Delivery then also takes place outside the EU, covered by standard contractual clauses.
src.captchacore.eu
114 locations worldwide:
Europe: all 35 European locations
North America: New York, Washington, Chicago, Dallas, Los Angeles, Seattle, Miami, Atlanta, Toronto, Montreal
South America: São Paulo, Buenos Aires, Bogotá, Lima, Santiago
Asia-Pacific: Singapore, Hong Kong, Tokyo, Seoul, Mumbai, Delhi, Manila, Osaka, Jakarta
Oceania & Middle East: Sydney, Melbourne, Auckland, Dubai, Doha, Istanbul
Important for your privacy policy: verification always runs in Germany, only the delivery of the script file can happen worldwide. What that means in detail.
Try the check in the live demo, look at the pricing, or read in the documentation how the integration works.
Permanently free for private websites · Processing in Germany · Data processing agreement in your account