PrivacyTools.io
Reviewed by Marcus Holmberg
mCaptcha logo

mCaptcha

mcaptcha.org
1 rating so far*
Rate mCaptcha:
No account needed

mCaptcha is a self-hosted CAPTCHA written in Rust that uses proof-of-work to rate-limit abusive traffic. The visitor’s browser computes a short puzzle before a request goes through, so a flood of automated requests becomes slow and costly. It does not track or profile visitors, and the core is licensed under the AGPL.

Threat level
Hardened

A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels

Screenshot of the mCaptcha website
Share
Our take

mCaptcha takes the same privacy-respecting approach as ALTCHA and aims it squarely at flood protection: it does not use a visitor’s IP address to rate-limit and it builds no profile, while every check stays on infrastructure you control. For a webmaster who already self-hosts and is comfortable on the command line, the lightweight Rust backend is a clean fit. The catch is twofold. The ecosystem is smaller than the bigger names, so you lean on the project’s own docs, and there is no managed tier, so you own the deployment and its upkeep. Pick it if you run your own stack and want spam control with zero visitor tracking. Skip it if you need a drop-in widget someone else hosts.

AGPL-3.0 actix-webcaptchaddos-mitigationddos-protectionmcaptchaprivacyproof-of-workrustself-hostself-hostedspam-protection
Stars
2,501
+2 this week
Forks
96
13 watching
Last commit
1.1y ago
slowing
Latest release
v0.1.0
2.7y ago, 2 total
Star history
Issues
41% closed
47
open
33
closed
+1 / -0
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
0 commits, active 0 of 26 weeks
17 contributors since Mar 2021
Languages
  • Rust 60.6%
  • TypeScript 22.2%
  • HTML 9.5%
  • Other 7.7%
Updated daily from the GitHub API. Star tracking since Jun 30, 2026.
Website at a glance
mcaptcha.org
D score 30
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 6d ago

Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.

mCaptcha alternatives

mCaptcha license, in plain English
AGPL-3.0
Strong copyleft · network

Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.

Permits

  • Commercial use
  • Modification
  • Distribution
  • Patent use
  • Private use

Requires

  • Disclose source
  • Network use is distribution
  • Same license
  • State changes
  • License and copyright notice

Does not provide

  • Liability cover
  • Warranty

Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.

Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.

* Average ratings will show on this page once the threshold of 5 ratings is reached.