A captcha that asks nobody for permission

security/captcha is a slider puzzle rendered on your own server: a background image with a gap, a loose piece, and a drag to put it back.

Every hosted captcha is a third party watching your visitors on a page you control, usually the login or the contact form, which is the page where you can least justify it. It is also a dependency: a form that stops working when someone else's service is down or changes its terms.

So this one has no service behind it. The server picks a secret gap position, draws the background and the piece with GD, and the position never leaves the machine. Verification checks the end position and the drag behaviour, which is the part that matters: timing, path shape and variation, because a script drags in a straight line at constant speed and a hand does not. Each puzzle is single-use and bound to the session, so a solved one cannot be replayed.

It is not equivalent to a large service with a global view of bot behaviour, and it does not claim to be. What it is equivalent to is the actual threat most forms face, which is a script hitting an endpoint, not a targeted attack. Against that it works, and it costs one resource in data/app.json.

Paired with security/rate it covers the usual ground: the captcha stops the casual script, the rate limit stops the persistent one.

Engine 1.0. See captcha in the manual.