ALTCHA_HMAC_KEY Generator — HMAC-SHA256 key for Altcha CAPTCHA

What is Altcha?

Altcha is an open-source, self-hostable CAPTCHA alternative based on proof-of-work rather than tracking or image puzzles. The server issues a signed challenge; the client's browser solves it with a small amount of computation, then submits the solution back for verification.

The signature on each challenge is an HMAC-SHA256 computed with a secret key — ALTCHA_HMAC_KEY. Anyone who knows this key can forge valid-looking solutions, so it must stay server-side only and never ship to the client bundle.

How to add it to your project

Copy the generated key into your server-side .env:
```
ALTCHA_HMAC_KEY=<paste here>
```

Pass it to altcha-lib when creating and verifying challenges:

import { createChallenge, verifySolution } from 'altcha-lib';

const challenge = await createChallenge({
  hmacKey: process.env.ALTCHA_HMAC_KEY!,
});

const ok = await verifySolution(payload, process.env.ALTCHA_HMAC_KEY!);

Never expose ALTCHA_HMAC_KEY to the client — it belongs only in server-side environment variables (API routes, Edge Functions), not in NEXT_PUBLIC_* or client bundles.

Frequently asked questions

What is ALTCHA_HMAC_KEY used for?

Altcha is a privacy-first, proof-of-work CAPTCHA alternative. The server signs each challenge with an HMAC-SHA256 key so it can later verify the client's solution wasn't forged or replayed. That key is the ALTCHA_HMAC_KEY (or hmacKey option in altcha-lib).

How long should the key be?

32 bytes (256 bits) of hex, matching HMAC-SHA256's block size, is the standard choice and what this tool generates. Altcha itself doesn't enforce a minimum length, but shorter keys reduce the security margin.

Can I use the same key across environments?

No — use a different ALTCHA_HMAC_KEY per environment (dev, staging, production). If it leaks in one environment, only that environment's challenges are compromised.

Is the generated key uploaded anywhere?

No. It's generated entirely in your browser using crypto.getRandomValues, the same CSPRNG used by Node's crypto.randomBytes and OpenSSL. Nothing is sent to any server.

Altcha HMAC Key Generator

What it does

Privacy

When to use this tool

Common mistakes