Cap review
A privacy-focused web CAPTCHA for teams prepared to host and operate it themselves.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Cap is an open-source CAPTCHA for websites that need bot protection without sending visitor data to a third party. It is aimed at developers who want to self-host verification and control how the CAPTCHA runs. The browser widget can execute challenges invisibly in the background, using proof-of-work and time-lock challenges alongside dynamically generated JavaScript and browser instrumentation checks. A dashboard supports multiple site keys, and the project is Apache 2.0 licensed.
The main fit question is deployment and ecosystem scope. Cap provides a standalone backend, Docker-based deployment, customizable web components, and a reCAPTCHA-compatible siteverify API. Those pieces suit a web integration that can operate its own backend; the documented SDK scope is web. Self-hosting also puts infrastructure responsibility with the deployer, so Cap is less suited to teams seeking a vendor-managed CAPTCHA service or a deployment outside its web focus.
Privacy is a notable design choice: Cap is described as using no cookies, tracking, or third-party verification calls. Its challenge mix includes proof-of-work, GPU-resistant time-lock challenges, and browser checks, but challenge variety is limited. The project documents privacy, accessibility, and regulatory considerations for self-hosted deployments. It is a strong candidate for privacy-focused developers comfortable operating their own CAPTCHA service; teams that need broader challenge variety or managed operations should consider alternatives. The pricing model is open source, with infrastructure costs borne by whoever deploys it.
Cap pros and cons
- Where it wins
- Keeps verification on your deployment without cookies or tracking.
- Combines proof-of-work with JavaScript and browser checks.
- Offers a reCAPTCHA-compatible siteverify API and multiple site keys.
- Where it doesn't
- Self-hosting means the deployer bears infrastructure costs.
- Its verified scope is web-focused, with web SDK support.
- Challenge variety is limited, and support is through documentation.
Cap fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update