What is altcha-deobfs?

Altcha Deobfuscation is a proof-of-concept tool that exposes a serious flaw in a security feature offered by Altcha, a service that provides "proof-of-work" widgets to protect websites from spam and abuse. The tool demonstrates that Altcha's text scrambling (obfuscation) scheme, which is supposed to require significant computational effort to decode, can actually be broken instantly and effortlessly. Altcha's obfuscation is designed to work like a puzzle: when data is hidden, the website visitor's browser is supposed to laboriously guess and check a large range of numbers to find the right one that unlocks the text. This computational work is meant to deter automated bots. However, the author discovered that due to how Altcha implemented the encryption, the secret key needed to unlock the data is essentially left in plain sight. Instead of forcing a computer to search through millions of possibilities, the tool can extract the hidden text in "constant time", meaning it takes roughly the same tiny fraction of a second regardless of how complex the original puzzle was supposed to be. This tool is primarily for security researchers, developers auditing web dependencies, and anyone evaluating whether Altcha's protection is robust enough to trust. For example, if a startup relies on Altcha to protect a contact form from spam bots, this tool demonstrates that a bot can bypass that protection almost instantly, rendering the anti-abuse feature no more effective than simple, non-secure encoding like base64. The author shared this tool alongside a formal vulnerability report to warn the community that the protection is fundamentally broken. The repository is also notable for the responsible disclosure process the author attempted before publishing. The author contacted Altcha multiple times to report the issue privately, but when the company failed to respond and later disputed the validity of the vulnerability, the author published the proof-of-concept and supporting evidence. The core cryptographic routine used to break the scheme is separated into an independent library, giving other developers an educational resource for understanding why this specific encryption setup fails.