Download the PHP package brainfoolong/justnocaptcha without Composer

JustNoCaptcha - Proof Of Work Captcha/Challenge/Brute Force protection, without any required user interaction. As of todays technology and capability of AI that can solve any "I am human" captcha faster than any human on earth, protecting backends is now different from what we are all used to from the past.

Having a captcha that need to be solved by hand has absolutely no advantage today nor it can proove the existence of humans in the progress. Instead, if you wish to protect your backend from to much requests in a short period (brute force), you need something that is hard to calculate, but easy to verify.

JustNoCaptcha has a simply approach, it creates invisible puzzles that the client must solve. This can be as expensive as you want. Verifying the solved puzzle is cheap on server side, so you don't waste server resources. It can even be used for machine-to-machine interactions, for example to protect your API. Technically, JustNoCaptcha is not a captcha per-se, it's just a way to slow down attempts that can be made in a certain amount of time (Just a brute force protection). But we still use the word captcha as almost everyone is used to it.

Features

• Multiple architectures, cross-browser

  • Cross-Browser, no IE
  • PHP 8+
  • NodeJS 16+
  • Bun
  • Typescript
  • Javascript
  • GoLang
  • Help implement more...
• Blazing fast server-side verification, don't waste any server resources to verify the clients solution
• Variable challenge/puzzle difficulty for the client (up to multiple minutes challenge calculation if required)
• Super slim browser library (~3kB unzipped, ~2 kB zipped)
• No external dependencies, neither in the browser nor on the server
• No tracking, no ads, just open-source
• Self hosted

Install

Live example

https://brainfoolong.github.io/justnocaptcha/

Usage

PHP Backend

JS/TS Backend

Browser

Browsers are only intended to use as a solver with the "-slim" library. If you need to create challenges in the browser, use the non slim browser library.

Go Backend

In-Depth: How it works and how is the performance

JustNoCaptcha uses an own compute intensive but memory efficient hashing algorithm that is standalone and suitable for both servers and clients to try to provide a good balance of performance on all devices. Slower devices such as old mobile phones are many times slower than newer devices or servers, so we had to use an algorithm that also this devices can solve in a reasonable amount of time. Here are some timing tests we have done in mid 2025 with different devices.

The algorithm can be ported to any programming language, as it just do some basic math and bitshift operations and only requires 32bit integers to work with.

An already verified challenge cannot be verified again, it will be invalid.

All tests uses 1 challenge with 50 puzzles and a difficulty of 4. Times stated here can vary a lot, depending on the hardware. It's just to have some basic numbers to see how it generally performs.