CAPTCHA Audit

Privacy audit tool for website bot-verification systems. Paste any URL, get an instant report on what CAPTCHA provider it uses, a privacy grade (A-F) based on data collection practices, and privacy-friendlier alternatives.

What It Does

• Fetches any URL server-side and scans HTML for known CAPTCHA provider script patterns
• Detects 10 CAPTCHA providers: Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, GeeTest, Arkose Labs, Amazon WAF, KeyCAPTCHA, Friendly Captcha, mCaptcha, Procaptcha
• Grades each provider A-F based on: third-party cookies, device fingerprinting, Google Play Services requirement, ad network data sharing, open source status
• Suggests privacy-friendlier alternatives ranked by grade
• Shareable audit reports via unique URLs
• Tracks CAPTCHA-related HN discussions via Algolia API

API Endpoints

| Method | Path | Description |
|--------|------|-------------|
| GET | /captcha-audit/health | Health check, returns { ok: true } |
| POST | /captcha-audit/api/audit | Submit URL for audit. Body: { "url": "https://..." } |
| GET | /captcha-audit/api/audit/:pid | Retrieve audit by shareable ID |
| GET | /captcha-audit/api/recent | Last 50 audits. Query: ?limit=N |
| GET | /captcha-audit/api/providers | Full CAPTCHA provider catalog with privacy profiles |
| GET | /captcha-audit/api/stats | Aggregate stats: total audits, grade distribution, top providers |
| GET | /captcha-audit/api/hn | Latest CAPTCHA-related HN stories |

Data Sources

| Source | URL | Refresh Interval |
|--------|-----|-----------------|
| Target URL HTML | Server-side fetch() of user-submitted URLs | On-demand per request |
| CAPTCHA provider patterns | Curated from Wappalyzer OSS rules (static, baked into lib/providers.js) | N/A |
| HN Algolia API | https://hn.algolia.com/api/v1/search?tags=story&query=captcha&hitsPerPage=20 | Every 60 minutes via node-cron |

Run Locally

npm install
PORT=4752 node server.js
# Open http://localhost:4752/captcha-audit/

Stack

• Node.js >= 22, Express, better-sqlite3 (WAL mode), node-cron, helmet, compression
• Vanilla JS SPA frontend with dark theme
• SQLite database stored in data/captcha-audit.db