Open source bot detection

Protect your forms without selling your users.

Self-hosted alternative to Turnstile and reCAPTCHA. Proof-of-work, fingerprinting, behavioral analysis. Your servers, your data.

$ docker compose up -d
your-app.com/login
1 Challenge requested ok
2 Fingerprint collected 14 signals
3 Behavior analyzed human-like
4 PoW solved 1,847ms
5 GeoIP check residential
Risk score
15
Actionallow
Tokenjns_tok_a8f2...c41d

Integration

Works with your stack

First-party SDKs for React, Next.js, and Express. Or use the 5KB browser SDK directly.

npm install @janus/react @janus/sdk
import { JanusProvider, useJanus } from '@janus/react';

function LoginForm() {
  const { execute, loading } = useJanus();

  const handleSubmit = async (e) => {
    e.preventDefault();
    const { success, token } = await execute();
    if (success) { /* submit with token */ }
  };

  return (
    <form onSubmit={handleSubmit}>
      <button disabled={loading}>Log in</button>
    </form>
  );
}

Comparison

Why switch

Turnstile / reCAPTCHAJanus
DataSent to Cloudflare / GoogleStays on your servers
PrivacyThird-party cookies, trackingNo cookies, no tracking
ScoringBlack boxOpen source, tunable
InfraExternal dependencySelf-hosted
SDK50-200 KB~5 KB gzipped
CostFree tier with limitsFree forever

Detection

Multiple layers, one score

Every verification combines 20+ independent signals into a single risk score from 0 (human) to 100 (bot).

Proof-of-Work

SHA-256 in Web Worker. Auto-scales under attack.

Fingerprinting

Canvas, WebGL, audio, fonts. Hashed, never raw.

Behavioral Analysis

Mouse velocity, keyboard timing, scroll, touch.

Automation Detection

Selenium, Puppeteer, PhantomJS, CDP, headless.

GeoIP Intelligence

Datacenter, VPN, proxy. Self-hosted MaxMind.

Adaptive Difficulty

PoW difficulty auto-increases during attacks.

Plugin System

Custom scoring logic. Global or per-site.

Email Alerts

SMTP alerts with per-event throttling.

Webhook Events

HMAC-signed payloads on block/spike.

~5 KB

SDK gzipped

20+

detection signals

168

tests passing

0

browser deps

Start protecting your forms.

Deploy in minutes. No vendor lock-in. MIT licensed.