---
id: altcha
version: "2.1.0"
license: unclear
license_treatment: permissive
maintenance: active
---

# altcha — A library for creating and verifying challenges for ALTCHA.

License: permissive · Maintenance: active · Downloads: 296.5K/mo

## What it is and what it does

ALTCHA is a zero-dependency Python library for creating and verifying proof-of-work challenges designed to protect against automated attacks. It implements PoW v2, which uses key derivation functions (KDFs) instead of simple hash matching—clients must find a counter value whose derived key starts with a required prefix. The library supports multiple algorithms: fast iterated SHA variants for testing, PBKDF2 for general use, and memory-hard algorithms like scrypt and Argon2id that resist GPU/ASIC attacks.

The typical workflow is server-side: create a challenge with a chosen algorithm and cost, send it to the client, which solves it by brute-forcing counter values, then transmit the solution back to the server for verification. The library handles challenge expiry, optional HMAC signing for tamper detection, and a fast verification path when you pre-solve challenges server-side. It also supports custom KDF functions and server signature verification via the ALTCHA Sentinel API.

Use it for:

- Protect web forms and APIs from bot submissions by requiring clients to solve a proof-of-work challenge before accepting requests.
- Implement rate limiting or anti-spam mechanisms that are resistant to GPU-accelerated attacks using memory-hard algorithms.
- Verify that a client performed computational work before granting access to expensive resources or rate-limited endpoints.
- Embed tamper-proof challenges in web applications by signing them with HMAC and verifying the signature server-side.
- Test proof-of-work implementations quickly using fast SHA-based algorithms without deploying memory-hard variants.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Creates and verifies ALTCHA proof-of-work challenges using key derivation functions like PBKDF2, Argon2id, and scrypt to defend against automated attacks.

Yes. The library is actively maintained, has zero runtime dependencies, installs easily, carries no known vulnerabilities, and solves a real problem (bot protection via proof-of-work). It is permissively licensed and supports current Python versions. Install it if you need ALTCHA challenge generation and verification; the API is straightforward and the documentation includes working examples.

## Install

pip install altcha
uv add altcha
poetry add altcha

## Installing altcha

Before you install: Installs with no runtime dependencies and is actively maintained; last release was 18 days ago with a recent commit on 2026-07-27.

License in practice: Licensed under MIT (permissive), so you can use, modify, and distribute it freely in commercial and open-source projects.

Quickstart:

pip install altcha

from altcha import create_challenge, solve_challenge, verify_solution, Payload

challenge = create_challenge(algorithm="PBKDF2/SHA-256", cost=5_000, hmac_secret="secret")
solution = solve_challenge(challenge)
payload_b64 = Payload(challenge, solution).to_base64()
result = verify_solution(payload_b64, "secret")
print(result.verified)

Requires Python 3.9 or later. Argon2id support requires optional argon2-cffi dependency.

Verify before relying:

- Whether the library is suitable for production web applications at scale beyond the stated monthly download volume.
- Performance characteristics and typical solve times for different algorithm/cost combinations in real deployments.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 296.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

proof of work challenge verification, ALTCHA challenge library, bot protection proof of work, key derivation function proof of work, PBKDF2 Argon2id challenge solver, anti-bot challenge system, memory-hard proof of work, proof-of-work, bot-protection, cryptography

[View on SkillFed](https://skillfed.io/packages/altcha) · [View on PyPI](https://pypi.org/project/altcha/)