No Google reCAPTCHA. No hCaptcha. No third parties, no cookies, no fingerprinting. Drop it in – done. Free & open source.
Three different CAPTCHA types – all without a single external request.
⟶ HMAC-SHA256 signed token · Valid 5 minutes · Server-side validation via CaptchaValidator.php
Built for Europe – designed for GDPR from the ground up.
Every successful solve produces a cryptographically signed token. Validated server-side in milliseconds – replay attacks prevented.
No connection to Google, Cloudflare or any third party. Everything runs in the user's browser on your own domain.
No localStorage, no sessionStorage, no cookies. No consent banner required under GDPR Art. 7.
Puzzle Slider, Image Rotation and Honey Math – randomly chosen or manually configured. Anti-bot through variety.
Drop-in class for PHP 8.x with Redis and PDO support for nonce blacklisting. Laravel-compatible.
captcha.js contains everything: styles are auto-injected. No npm, no build step, no CDN required.
| Feature | einfach-captcha.de | Google reCAPTCHA | hCaptcha |
|---|---|---|---|
| GDPR-compliant out of the box | ✓ Yes | ✗ No | ⚠ Partial |
| External requests | ✓ None | ✗ Google servers | ✗ hCaptcha servers |
| Cookies / tracking | ✓ None | ✗ Yes | ✗ Yes |
| Consent banner required | ✓ No | ✗ Yes | ✗ Yes |
| Fingerprinting | ✓ No | ✗ Yes | ✗ Yes |
| Data sent to third party | ✓ None | ✗ Intuition Machines | |
| Self-hosted | ✓ Yes | ✗ No | ✗ No |
| Open Source | ✓ Yes | ✗ No | ✗ No |
Include one JS file, set a container element. No CDN, no external resources needed.
Slide a puzzle piece, rotate an image or solve a math challenge. Intuitive, touch-friendly.
On success: HMAC-SHA256 signed token with type, timestamp, expiry and cryptographic nonce.
CaptchaValidator.php checks signature, expiry and replay protection in under 1ms.
No build step, no npm install, no configuration needed.
<!-- 1. Include JS (one file, zero dependencies) --> <script src="captcha.js"></script> <!-- 2. Container in your form --> <div id="my-captcha"></div> <input type="hidden" name="captcha_token"> <!-- 3. Initialise --> <script> const captcha = new PrivateCaptcha('#my-captcha', { type: 'auto', // 'puzzle' | 'rotate' | 'math' | 'auto' secretKey: 'YOUR_SERVER_SECRET', lang: 'en' }); captcha.onSolve(token => { document.querySelector('[name=captcha_token]').value = token; }); </script> // 4. Validate server-side (PHP) // $v = new CaptchaValidator($_ENV['CAPTCHA_SECRET']); // if (!$v->validate($_POST['captcha_token'])->isValid()) abort(422);
Free, open source, deploy in minutes.