PHPackages                             cluion/turing - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. cluion/turing

ActiveLibrary[Security](/categories/security)

cluion/turing
=============

Self-hosted, zero-dependency, cross-language modern captcha with a Laravel integration.

v1.0.0(1mo ago)11[2 PRs](https://github.com/cluion/turing/pulls)MITPHPPHP >=8.2CI passing

Since Jul 10Pushed 6d agoCompare

[ Source](https://github.com/cluion/turing)[ Packagist](https://packagist.org/packages/cluion/turing)[ Docs](https://github.com/cluion/turing)[ RSS](/packages/cluion-turing/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (7)Dependencies (3)Versions (8)Used By (0)

Turing
======

[](#turing)

[![CI](https://github.com/cluion/turing/actions/workflows/ci.yml/badge.svg)](https://github.com/cluion/turing/actions/workflows/ci.yml)[![npm](https://camo.githubusercontent.com/125a55d6c20c8f96332bfee50d3a624731b94b7c9b877fd80909e71721723518/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f762f40636c75696f6e2f747572696e672d636f72653f6c6162656c3d6e706d253230253430636c75696f6e253246747572696e672d636f7265)](https://www.npmjs.com/package/@cluion/turing-core)[![Packagist](https://camo.githubusercontent.com/5ecedc7e809f7b4b97a6d0379ce0f772842a22314d29f2d03ff390b19936675b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f636c75696f6e2f747572696e673f6c6162656c3d7061636b6167697374253230636c75696f6e253246747572696e67)](https://packagist.org/packages/cluion/turing)[![License: MIT](https://camo.githubusercontent.com/7013272bd27ece47364536a221edb554cd69683b68a46fc0ee96881174c4214c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e737667)](#license)

**English** · [繁體中文](README.zh-TW.md) · 📖 [Documentation](https://cluion.github.io/turing/)

A signed challenge the server issues, a client widget that solves it in the browser with native Web Crypto, and a token the enclosing form submits for the server to verify. No external service, no tracking. Three layers: a framework-agnostic **PHP Core**, framework **integrations** (Laravel first), and a **JS client** stack.

Install
-------

[](#install)

### Laravel (PHP)

[](#laravel-php)

```
composer require cluion/turing
```

```
php artisan vendor:publish --tag=turing-config   # then set TURING_SECRET
```

### JavaScript

[](#javascript)

PackageInstallUse[`@cluion/turing-core`](https://www.npmjs.com/package/@cluion/turing-core)`pnpm add @cluion/turing-core`Headless core (plain / any framework)[`@cluion/turing-element`](https://www.npmjs.com/package/@cluion/turing-element)`pnpm add @cluion/turing-element``` Web Component[`@cluion/turing-vue`](https://www.npmjs.com/package/@cluion/turing-vue)`pnpm add @cluion/turing-vue``` Vue 3 component[`@cluion/turing-react`](https://www.npmjs.com/package/@cluion/turing-react)`pnpm add @cluion/turing-react``` React componentPlain HTML via CDN — pin an exact version and add Subresource Integrity:

```

```

Usage
-----

[](#usage)

### Laravel — one line to show, one line to verify

[](#laravel--one-line-to-show-one-line-to-verify)

```

  @csrf

  Send

```

```
$request->validate(['turing_token' => 'required|turing']);
// or: Turing::verifyRequest($request);
```

The `` component renders a CSP-safe container the client widget mounts onto. The widget fetches the challenge from `data-turing-url`, solves the PoW with native Web Crypto (no WASM), and injects a hidden `turing_token` for the form to submit.

### JavaScript

[](#javascript-1)

```
import '@cluion/turing-core'; // auto-mounts every [data-turing] container
```

A runnable plain-HTML page is in [`examples/plain-html/index.html`](examples/plain-html/index.html). Framework guides: [Laravel](docs/guide/laravel.md) · [Plain HTML](docs/guide/plain-html.md)· [Vue](docs/guide/vue.md) · [React](docs/guide/react.md) · [Security](docs/guide/security.md).

Core
----

[](#core)

Framework-agnostic PHP core under `php/src/Core`. Token = `base64url(payload).base64url(signature)` with canonical (sorted-key) JSON. HMAC-SHA256 default signing (Ed25519 opt-in). Challenge types: `math`, `text`, `pow` (PBKDF2-SHA256 default, SHA-256 leading-zero-bit opt-in). Stateless by default; single-use via a `Store`.

Cross-language vectors
----------------------

[](#cross-language-vectors)

[`php/tests/vectors/`](php/tests/vectors/) is the wire contract — the authoritative [wire-contract reference](docs/reference/wire-contract.md) quotes them verbatim (a docs build guard fails on drift). Language ports MUST reproduce these fixtures exactly (token bytes, PoW counters, answer hashes). Binary payload fields (e.g. `keySignature`) are always base64url of the raw bytes.

Development
-----------

[](#development)

```
composer install
vendor/bin/phpunit                 # PHP: Core + Laravel suites (Laravel 10–13 in CI)

cd js && pnpm install
pnpm -r build && pnpm -r test      # JS: 4 packages (build before test)
pnpm -r typecheck

cd ../docs && pnpm docs:build      # docs site + vector drift guard
cd ../e2e  && pnpm exec playwright test   # browser round-trip (needs chromium)
```

License
-------

[](#license)

MIT.

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance95

Actively maintained with recent releases

Popularity3

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity51

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 98.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

7

Last Release

47d ago

Major Versions

v0.3.1 → v1.0.02026-07-11

### Community

Maintainers

![](https://www.gravatar.com/avatar/b008f596ba58069f0b50370e71ac2b724d60178515725233c5fdd4717ec8ce27?d=identicon)[ningyungame](/maintainers/ningyungame)

---

Top Contributors

[![cluion](https://avatars.githubusercontent.com/u/88296296?v=4)](https://github.com/cluion "cluion (90 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (1 commits)")

---

Tags

captchajavascriptlaravelphpsecuritylaravelcaptchaproof-of-workpowturingcluion

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/cluion-turing/health.svg)

```
[![Health](https://phpackages.com/badges/cluion-turing/health.svg)](https://phpackages.com/packages/cluion-turing)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3345.4M354](/packages/psalm-plugin-laravel)[api-platform/laravel

API Platform support for Laravel

58190.1k21](/packages/api-platform-laravel)[forjedio/inertia-table

Backend-driven dynamic tables for Laravel + Inertia.js

272.0k](/packages/forjedio-inertia-table)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)