PHPackages                             trilbymedia/cap-php - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. trilbymedia/cap-php

ActiveLibrary[Security](/categories/security)

trilbymedia/cap-php
===================

PHP port of the Cap proof-of-work captcha server. Wire-compatible with @cap.js/widget.

1.0.0(2mo ago)5430Apache-2.0PHPPHP ^8.1

Since Apr 20Pushed 2mo ago1 watchersCompare

[ Source](https://github.com/trilbymedia/cap-php)[ Packagist](https://packagist.org/packages/trilbymedia/cap-php)[ Docs](https://github.com/trilbymedia/cap-php)[ RSS](/packages/trilbymedia-cap-php/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (2)Dependencies (2)Versions (4)Used By (0)

cap-php
=======

[](#cap-php)

PHP port of the [Cap](https://github.com/tiagozip/cap) proof-of-work captcha server.

Wire-compatible with the official [`@cap.js/widget`](https://www.npmjs.com/package/@cap.js/widget), so the unmodified JS widget can talk to a PHP-backed endpoint.

- SHA-256 proof-of-work — no tracking, no third-party calls, no API keys
- Small (~500 LOC), no runtime dependencies beyond ext-json / ext-hash
- Pluggable storage: in-memory, filesystem, or any PSR-16 cache

Install
-------

[](#install)

```
composer require trilbymedia/cap-php
```

Usage
-----

[](#usage)

```
use TrilbyMedia\Cap\Cap;
use TrilbyMedia\Cap\Config;
use TrilbyMedia\Cap\Storage\FilesystemStorage;

$storage = new FilesystemStorage('/var/lib/cap');
$cap = new Cap(new Config(
    challengeStorage: $storage,
    tokenStorage:     $storage,
));

// In your /challenge endpoint:
$result = $cap->createChallenge();
// echo json_encode($result);

// In your /redeem endpoint (body: {"token":"...","solutions":[...]}):
$result = $cap->redeemChallenge($token, $solutions);
// echo json_encode($result);

// When validating a form submission that carried a cap token:
if ($cap->validateToken($submittedToken)) {
    // success
}
```

Defaults
--------

[](#defaults)

OptionDefaultMeaningchallengeCount50Number of sub-challenges per captchachallengeSize32Salt length (hex chars)challengeDifficulty4Target prefix length (hex chars)expiresMs600 000Challenge TTL (10 min)token TTL20 minValidation token TTL (not configurable)Protocol compatibility
----------------------

[](#protocol-compatibility)

The PRNG and hashing are bit-exact with upstream `server/index.js` — verified by `tests/fixtures/prng-vectors.json`, a set of vectors generated directly from the upstream JS implementation.

License
-------

[](#license)

Apache-2.0, matching upstream.

###  Health Score

43

—

FairBetter than 89% of packages

Maintenance85

Actively maintained with recent releases

Popularity23

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity45

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~8 days

Total

3

Last Release

79d ago

Major Versions

0.1.1 → 1.0.02026-05-06

### Community

Maintainers

![](https://www.gravatar.com/avatar/6a85f5988e5b0457d61a12de933780ad099689271767b717feba55f04723c453?d=identicon)[rhukster](/maintainers/rhukster)

---

Top Contributors

[![rhukster](https://avatars.githubusercontent.com/u/1084697?v=4)](https://github.com/rhukster "rhukster (4 commits)")

---

Tags

securitycaptchaproof-of-worksha256cappowcap.js

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/trilbymedia-cap-php/health.svg)

```
[![Health](https://phpackages.com/badges/trilbymedia-cap-php/health.svg)](https://phpackages.com/packages/trilbymedia-cap-php)
```

###  Alternatives

[gregwar/captcha-bundle

Captcha bundle

3684.9M34](/packages/gregwar-captcha-bundle)[s1syphos/php-simple-captcha

Simple captcha generator

2740.9k13](/packages/s1syphos-php-simple-captcha)[bbysaeth/typo3-altcha

TYPO3 form element for spam protection by utilizing the proof-of-work mechanism Altcha.

1124.2k1](/packages/bbysaeth-typo3-altcha)[lorddashme/php-simple-captcha

A simple captcha package that fit to any type of web application built on php.

113.0k](/packages/lorddashme-php-simple-captcha)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)