Humancha

Humancha (portmanteau of Human and CAPTCHA) is a CAPTCHA API based on the Decoy Font by Mixfont.
It requires no Docker, no backend, and it is free and simple to use.

API documentation ↓

Human verification DEMO

Enter the characters shown below.

Audio CAPTCHA support is currently unavailable.

Documentation

API reference and integration details.

Overview

Humancha provides CAPTCHA challenges as WebP images. Retrieve a challenge with JavaScript and submit the user's answer for server-side verification.

GET /api/captcha

Creates a challenge. The response body contains the WebP image. Session information is returned through response headers.

Content-Type: image/webp
X-Captcha-Session: session-id
X-Captcha-Hash: signed-challenge-token
X-Captcha-Expires: unix-timestamp

Display the image

You can display a challenge using a regular img element.

<img
  src="https://YOUR-API-DOMAIN/api/captcha"
  alt="CAPTCHA"
>

An image element cannot read the session and challenge headers. Use JavaScript fetch when verification is required.

POST /api/captcha/verify

Submit the session ID, challenge hash, and user's answer as JSON.

{
  "session_id": "session-id",
  "captcha_hash": "signed-challenge-token",
  "answer": "user-answer"
}

Successful verification returns valid: true. Incorrect attempts are tracked per session.

POST /api/captcha/refresh

Send the current session ID and challenge hash. The response contains a new WebP image and new session headers.

{
  "session_id": "session-id",
  "captcha_hash": "signed-challenge-token"
}

Challenge behavior

Challenges expire after their configured lifetime. Verification is performed server-side. Incorrect attempts are tracked, and refreshed challenges receive new sessions.