PrivacyTools.io
Reviewed by Marcus Holmberg
mCaptcha logo

mCaptcha

mcaptcha.org
No ratings yet. Be the first.
Rate mCaptcha:
No account needed

mCaptcha is a self-hosted CAPTCHA written in Rust that uses proof-of-work to rate-limit abusive traffic. The visitor’s browser computes a short puzzle before a request goes through, so a flood of automated requests becomes slow and costly. It does not track or profile visitors, and the core is licensed under the AGPL.

Threat level
Hardened

A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels

Screenshot of the mCaptcha website
Share

Embed your badge

Show visitors mCaptcha is listed on PrivacyTools.io, and invite ratings.

Style
Theme
Size
Preview
mCaptcha on PrivacyTools.io
HTML embed code
Markdown embed code

Markdown is handy for a GitHub README or docs. It renders at the badge's natural size.

Stars refresh once a day. Open the badge builder
Our take

mCaptcha takes the same privacy-respecting approach as ALTCHA and aims it squarely at flood protection: it does not use a visitor’s IP address to rate-limit and it builds no profile, while every check stays on infrastructure you control. For a webmaster who already self-hosts and is comfortable on the command line, the lightweight Rust backend is a clean fit. The catch is twofold. The ecosystem is smaller than the bigger names, so you lean on the project’s own docs, and there is no managed tier, so you own the deployment and its upkeep. Pick it if you run your own stack and want spam control with zero visitor tracking. Skip it if you need a drop-in widget someone else hosts.

GitHub at a glance
mCaptcha/mCaptcha
Stars
2,472
+ 5 this week
Last commit
9mo ago
slowing
License
AGPL-3.0
Latest release
v0.1.0
2.3y ago
Stars, last 31d
Website at a glance
mcaptcha.org
D score 30
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 14d ago

Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.

mCaptcha alternatives

mCaptcha license, in plain English
AGPL-3.0
Strong copyleft · network

Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.

Permits

  • Commercial use
  • Modification
  • Distribution
  • Patent use
  • Private use

Requires

  • Disclose source
  • Network use is distribution
  • Same license
  • State changes
  • License and copyright notice

Does not provide

  • Liability cover
  • Warranty

Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.

Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.

* Average ratings will show on this page once the threshold of 5 ratings is reached.