Origami CAPTCHA

Origami CAPTCHA is a self-hosted, zero-JavaScript "Drag The Item" CAPTCHA authorization provider written in Go. Users solve a responsive visual puzzle by moving two origami objects onto their matching upright outlines.

Demo

• Standalone CAPTCHA
• Contact form example

Primary purpose

Origami CAPTCHA is designed for environments where client-side JavaScript is unavailable, unwanted, or deliberately disabled.

• Tor Browser users running NoScript or higher security modes that disable JavaScript.
• Privacy-focused deployments that want a CAPTCHA option without third-party scripts, tracking widgets, or browser-side behavioral collection.
• Accessibility and compatibility fallback.
• Additional CAPTCHA variation for Tor environments

How dragging works without JavaScript

The interaction uses native HTML form controls and CSS while the server keeps all challenge state:

1. Each origami piece is a `` connected to a hidden radio input. Clicking or tapping the piece selects it without JavaScript.
2. CSS uses the selected radio's :checked state to change the cursor into that origami piece.
3. A transparent `` covers the challenge canvas. While it is active, CSS hides the original piece, creating the visual effect of picking it up and dragging it.
4. When the user releases or taps the canvas, the browser natively submits pick.x and pick.y coordinates to /c/{challenge_id}.
5. The server stores the submitted position and renders the updated challenge page. No position or solution state is stored in browser JavaScript.
6. Pressing Confirm sends a normal form POST to /verify. The server checks whether both submitted coordinates are close enough to their matching upright outlines.

The essential browser behavior is provided by:

...

An image input automatically submits coordinates as pick.x and pick.y, which makes the server-driven drag interaction possible without executable client-side code.

Limitation on mobile

The desktop drag effect depends on a mouse cursor that can visually become the selected origami piece. Touch devices do not have that cursor, so a true drag effect is not available without client-side JavaScript. On mobile, the challenge intentionally uses a tap-to-place flow instead: tap an origami piece to select