LightCaptcha is a free, self-hosted CAPTCHA. No API keys. No third-party calls. Real users pass invisibly — bots get the puzzle.
Most visitors never see a puzzle. LightCaptcha scores behavior silently and only shows the jigsaw challenge when something looks suspicious.
Mouse movement, timing, and interaction patterns are recorded silently in the background.
After a short window, the score is checked. Human-like behavior passes immediately — no puzzle shown.
Bots and suspicious sessions are shown a jigsaw drag-to-place challenge before proceeding.
On form submit, your server validates an HMAC-signed token. One function call — that's it.
Built to be dropped into any PHP, Python, or Node.js project in minutes.
Your server. Your data. No calls to external services, ever. GDPR-friendly by design.
Genuine users pass with no friction. The jigsaw puzzle only appears when behavior looks suspicious.
A simple, accessible drag-to-place puzzle. 10 bundled images, or point it at your own folder.
Pure JavaScript widget. No jQuery, no npm, no CDN calls. One script tag and you're done.
Auto-detects system preference, or set it manually. Looks right on any site.
Server libraries for all three. Same HMAC-based token design across every language.
Three steps: add the widget, run the verify endpoint, check the token on submit.
<!-- In your <head> --> <script src="/lightcaptcha/js/lightcaptcha.js"></script> <!-- In your form --> <div data-lightcaptcha data-lc-verify="/lightcaptcha/server/lightcaptcha-verify.php" data-lc-images="/lightcaptcha/images"> </div>
define('LIGHTCAPTCHA_SECRET', 'your-secret-key'); require_once 'lightcaptcha/server/lightcaptcha.php'; if (!LightCaptcha::check()) { http_response_code(400); die('Captcha verification failed.'); } // Safe to process the form
Free forever. MIT licensed. Your data stays on your server.