Security model — explained honestly

simplecaptcha is a proof-of-work captcha with passive signals. We tell you exactly what that achieves — and what it doesn't.

What simplecaptcha does

1. Force work. Every form submission requires a memory-hard computation (Argon2id, RFC 9106; default 4 puzzles × 8 MiB) in the visitor's browser. For humans: invisible, ~0.5–1.5 s in the background while they type. For attackers: real compute cost per attempt that GPUs can't optimize away — Argon2id is deliberately memory-bound.
2. Make suspicious traffic expensive. Passive signals — short-lived hashed-IP counters, missing browser headers, solve-timing patterns — automatically raise difficulty 2–8×. No cookies, no fingerprinting, no device access (§ 25 TDDDG compliant without consent).
3. Prevent replay. Every token is bound to your domain (Ed25519-signed), valid for 5 minutes, and redeemable exactly once.

What simplecaptcha does not claim

No captcha "detects bots". Image puzzles are solved by machines or delegated to click farms for fractions of a cent. simplecaptcha takes an economic approach: mass abuse (spam, credential stuffing, card testing) only pays off when an attempt costs practically nothing. We make every attempt cost something — and suspicious attempts cost much more.

A targeted human attack on your specific form is not prevented. No captcha prevents that.

Why this is GDPR-compliant without a banner

• Processing under Art. 6(1)(f) GDPR (Recital 49: network and information security); no consent required.
• No access to device information under § 25 TDDDG: no cookies, no localStorage, no canvas/audio/WebGL fingerprinting.
• Visitor data is processed only ephemerally in Germany: IP addresses exist solely as salted hashes in counters with minute-level TTLs, the salt is process-local — technically unlinkable after a restart. No database table with visitor data exists.
• Your statistics consist exclusively of anonymous hourly counters per site.