altcha

What it is and what it does

ALTCHA is a zero-dependency Python library for creating and verifying proof-of-work challenges designed to protect against automated attacks. It implements PoW v2, which uses key derivation functions (KDFs) instead of simple hash matching—clients must find a counter value whose derived key starts with a required prefix. The library supports multiple algorithms: fast iterated SHA variants for testing, PBKDF2 for general use, and memory-hard algorithms like scrypt and Argon2id that resist GPU/ASIC attacks.

The typical workflow is server-side: create a challenge with a chosen algorithm and cost, send it to the client, which solves it by brute-forcing counter values, then transmit the solution back to the server for verification. The library handles challenge expiry, optional HMAC signing for tamper detection, and a fast verification path when you pre-solve challenges server-side. It also supports custom KDF functions and server signature verification via the ALTCHA Sentinel API.

Use it for:

• Protect web forms and APIs from bot submissions by requiring clients to solve a proof-of-work challenge before accepting requests.
• Implement rate limiting or anti-spam mechanisms that are resistant to GPU-accelerated attacks using memory-hard algorithms.
• Verify that a client performed computational work before granting access to expensive resources or rate-limited endpoints.
• Embed tamper-proof challenges in web applications by signing them with HMAC and verifying the signature server-side.
• Test proof-of-work implementations quickly using fast SHA-based algorithms without deploying memory-hard variants.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Creates and verifies ALTCHA proof-of-work challenges using key derivation functions like PBKDF2, Argon2id, and scrypt to defend against automated attacks.

Yes. The library is actively maintained, has zero runtime dependencies, installs easily, carries no known vulnerabilities, and solves a real problem (bot protection via proof-of-work). It is permissively licensed and supports current Python versions. Install it if you need ALTCHA challenge generation and verification; the API is straightforward and the documentation includes working examples.

Install

altcha on PyPI

pip install altcha

uv add altcha

poetry add altcha

Installing altcha

Before you install

Installs with no runtime dependencies and is actively maintained; last release was 18 days ago with a recent commit on 2026-07-27.

License in practice

Licensed under MIT (permissive), so you can use, modify, and distribute it freely in commercial and open-source projects.

Quickstart

pip install altcha

from altcha import create_challenge, solve_challenge, verify_solution, Payload

challenge = create_challenge(algorithm="PBKDF2/SHA-256", cost=5_000, hmac_secret="secret")
solution = solve_challenge(challenge)
payload_b64 = Payload(challenge, solution).to_base64()
result = verify_solution(payload_b64, "secret")
print(result.verified)

Requires Python 3.9 or later. Argon2id support requires optional argon2-cffi dependency.

Verify before relying

• Whether the library is suitable for production web applications at scale beyond the stated monthly download volume.
• Performance characteristics and typical solve times for different algorithm/cost combinations in real deployments.

Package facts

Evidence: altcha-2.1.0-py3-none-any.whl

Tags

More Cryptography packages