This page is for site owners and developers. If your login, sign-up or contact forms use reCAPTCHA, every visit loads Google code that collects signals about your visitors and sets a cookie. A reCAPTCHA alternative keeps the spam protection without sending that data to Google.
There are three good reasons to look now.
- Cost. reCAPTCHA now runs inside Google Cloud. The free tier covers 10,000 assessments a month across all your sites, and after that requests fail until the next month unless you add billing. Moving an older key into a Google Cloud project also requires billing to be turned on.
- Consent. France’s data protection authority and an Austrian court have both said reCAPTCHA can need visitor consent, which means it may have to wait for your cookie banner.
- Your visitors. Image puzzles are slow and annoying. Most of the tools below never show one.
Quick Comparison
| Tool | Best for | Price (Oct 2026) | Privacy | Based in | Open source |
|---|---|---|---|---|---|
| ALTCHA | No third party at all | Widget free; Cloud from €47/month; Sentinel from €99/month | No cookies, proof-of-work, runs on your server | Czechia | Yes (MIT core) |
| Friendly Captcha | A managed EU service | Free for non-commercial use; Starter €9, Growth €39, Advanced €200 a month | Proof-of-work plus risk signals; EU-only hosting on Advanced | Germany | Client SDK only (MPL-2.0) |
| Cloudflare Turnstile | Free at any traffic level | Free (20 widgets, unlimited challenges) | No image puzzles; signals go to Cloudflare | US | No |
| hCaptcha | Closest to reCAPTCHA’s API | Free; Pro $99/month billed yearly | Image challenges on the free plan | US | No |
| mCaptcha | Fully open source and self-hosted | Free | Proof-of-work on your server | Community project | Yes (AGPL-3.0) |
| Honeypot and rate limiting | Small sites | Free | Nothing leaves your server | Your server | Not applicable |
Which One Fits Your Site
- You want no third party in the loop. Use ALTCHA on your own server, or mCaptcha for a side project.
- You want a managed service with EU hosting. Use Friendly Captcha.
- You want free and quick, at any traffic level. Use Cloudflare Turnstile.
- Your platform only supports reCAPTCHA-style code. Use Turnstile’s compatibility mode or hCaptcha.
- You run a small blog or one contact form. Try a honeypot and rate limiting first.
The Alternatives, One by One
ALTCHA
ALTCHA is made by BAU Software in Czechia. Its open-source core has two parts, a JavaScript widget and server libraries that create and check the puzzles. Most visitors don’t need to click anything. The company describes it as accessible (WCAG) and GDPR-compliant.
- Pick it because everything stays on your own infrastructure, with no cookies, no tracking and no per-request fees.
- A possible deal-breaker is that you need a developer to set up the server side, unless you use ALTCHA Cloud, Sentinel or the WordPress plugin. Proof-of-work slows bots down rather than identifying them, so pair it with rate limiting on busy logins.
- Prices (Oct 2026) start at free for the open-source widget. ALTCHA Cloud is €47/month for 3 sites, Sentinel is €99/month on the Professional plan, and the WordPress plugin has a free plan for login, registration and comments, with paid plans from €18.90/month. Prices exclude VAT, and yearly billing gives two months free.
Friendly Captcha
Friendly Captcha is a German company. Its widget gives each visitor’s device a small puzzle that it solves in the background, combined with other risk signals, so people see no image challenge. It runs data centers in the EU, the US and Asia.
- Pick it because it’s a managed service from an EU company, and its official WordPress plugin covers most popular form plugins.
- Possible deal-breakers are the low request limits on the smaller plans and that EU-only data centers start at the Advanced plan. The service itself isn’t open source, though its client SDK is (MPL-2.0).
- Prices (Oct 2026) start with a free plan for non-commercial use (1 domain, 1,000 requests a month). Starter is €9/month (1 domain, 1,000 requests), Growth €39/month (5 domains, 5,000 requests) and Advanced €200/month (50 domains, 50,000 requests). Paid plans come with a 30-day trial.
Cloudflare Turnstile
Turnstile is Cloudflare’s free CAPTCHA replacement. It doesn’t use image puzzles and has three modes. Managed decides whether to show a checkbox, Non-interactive never asks the visitor to do anything, and Invisible hides the widget completely. You can use it without any other Cloudflare service.
- Pick it because it’s free with unlimited challenges and up to 20 widgets per account. Its compatibility mode lets most reCAPTCHA v2 forms switch by changing the script, the site key and the server check.
- Possible deal-breakers are that Cloudflare is a US company and that compatibility mode covers reCAPTCHA only up to v2. Its privacy addendum lists IP address, TLS fingerprint, user agent and site key as the signals it collects, used to detect bots for you and to improve Cloudflare’s own detection.
- It costs nothing (Oct 2026) for up to 20 widgets with 10 hostnames each. Enterprise plans raise those limits.
hCaptcha
hCaptcha is made by Intuition Machines, a US company. It says it’s API-compatible with reCAPTCHA, which makes it the closest drop-in.
- Pick it because you mostly change the script address, a class name, the keys and the verification URL, and your callbacks keep working.
- A possible deal-breaker is that, by hCaptcha’s own description, most visitors on the free plan see a challenge. The passive mode, where fewer than 0.1% of real users get one, needs Pro.
- Prices (Oct 2026) start at free. Pro is $99/month billed yearly or $139 month to month for 100,000 evaluations, then $0.99 per 1,000.
mCaptcha
mCaptcha is an open-source (AGPL-3.0) proof-of-work CAPTCHA that you host yourself, for example with Docker. The visitor’s browser solves a puzzle, mCaptcha checks it and issues a token, and your site verifies that token before it accepts the form.
- Pick it because every part is open source and self-hosted, with no company involved.
- A possible deal-breaker is maturity. It has no stable release yet, and its own README calls it a work in progress. Use it for side projects, not your checkout.
Honeypots and Rate Limiting
Many small sites don’t need a CAPTCHA at all. These measures cost nothing, send no data anywhere and give visitors nothing to solve.
- A honeypot is a hidden form field that people never see. Simple bots fill in every field, so reject any submission where it has a value. Hide it with CSS and mark it so screen readers and password managers skip it.
- Rate limiting caps how many form submissions or login attempts one IP address can make per minute, in your web server, firewall or app.
- Email confirmation for sign-ups and newsletters stops fake accounts from doing much.
- A timing check rejects forms submitted within a second or two of the page loading.
Add a CAPTCHA only if spam still gets through.
reCAPTCHA, GDPR and Consent
This part is about law, and the answer depends on your country and how your site uses reCAPTCHA. Use it to prepare a conversation with whoever handles privacy for your site.
- Google calls its cookie necessary. Google’s reCAPTCHA FAQ says it sets a “necessary” cookie,
_GRECAPTCHA, for its risk analysis. It also suggests loading reCAPTCHA from www.recaptcha.net if you want to avoid other google.com cookies. - France’s CNIL draws the line by purpose. In its cookie guidance, the CNIL says a CAPTCHA needs no consent if it only secures the site or a login for users, and needs consent if the data also serves other purposes. In 2022, according to Clubic, it told the French Interior Ministry that reCAPTCHA on a police complaint form needed consent, partly because it also allowed analysis by Google.
- An Austrian court required consent. In September 2024, Austria’s Federal Administrative Court ruled that a political party’s website should have asked for prior consent before setting reCAPTCHA’s cookie, because the cookie wasn’t technically necessary.
If many of your visitors are in the EU, the lowest-risk options are those that keep data on your side, such as ALTCHA, mCaptcha or a honeypot. Friendly Captcha’s EU hosting is the managed option. Turnstile and hCaptcha still send visitor signals to a US company, so review them with your privacy contact too.
How to Switch From reCAPTCHA
Find Every Place reCAPTCHA Runs
- List the forms that use it, such as login, sign-up, password reset, contact, comments and checkout.
- Open a page with a form, view the page source and search for “recaptcha”. Repeat on a page without a form, because some themes and plugins load it on every page.
- Note which plugin, theme setting or piece of code adds it.
On WordPress
- Pick a tool your form plugin supports. Contact Form 7 has Turnstile built in under Contact → Integration. Friendly Captcha’s official plugin covers Contact Form 7, WPForms, Gravity Forms, Elementor Pro, WooCommerce and the WordPress login, registration and comment forms.
- Create a site key and secret key in the new service’s dashboard, then paste them into the plugin’s settings. In Contact Form 7, click Setup integration in the Turnstile section.
- Test every form in a private window. Then remove the reCAPTCHA keys from your form plugin and deactivate any reCAPTCHA plugin.
On a Custom Site or App
The pattern is the same for every service. You swap the script, the widget’s site key and the server-side check.
| Service | On the page | On your server |
|---|---|---|
| Cloudflare Turnstile | Load https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha and use the Turnstile site key. Your grecaptcha.render() calls and the g-recaptcha-response field keep working. |
Send the token to https://challenges.cloudflare.com/turnstile/v0/siteverify as a POST request. GET isn’t supported. |
| hCaptcha | Load https://js.hcaptcha.com/1/api.js and rename the g-recaptcha class to h-captcha. |
Read h-captcha-response and verify it at https://api.hcaptcha.com/siteverify with your hCaptcha secret. |
| ALTCHA | Add the ALTCHA script and an <altcha-widget> element that points at your challenge endpoint. |
Create and verify challenges with one of ALTCHA’s server libraries, or with Sentinel. |
Friendly Captcha has its own SDK and verification API, and its documentation walks through both.
- Create the site in the new service and copy its site key and secret key.
- Change the form markup and script as shown above, on every form you listed.
- Change the server-side check, then deploy to a test environment.
- Submit each form normally, then try one with the token removed. The server must reject it.
On Site Builders and Hosted Forms
On hosted site builders and form services, the platform usually chooses the bot protection. Check its settings for a CAPTCHA option or ask its support team. If you can’t change it, moving your forms to a privacy-friendly form tool may be simpler. Our Google Forms alternatives page compares a few.
Clean Up
- Search your page source again for “recaptcha” and “gstatic” to confirm nothing is left.
- Update your privacy policy and cookie banner so they name the new service, or drop the CAPTCHA entry if you now use a honeypot.
- Delete the old site keys in the reCAPTCHA admin console or the Google Cloud console. If the Google Cloud project held nothing else, see our Google Cloud alternatives for how to shut it down.
- Watch your spam and failed logins for a week or two, and add rate limiting or tighten the widget’s settings if needed.
Your website is only one part of your Google footprint. Our free scan reads files you download from Google and shows what else still depends on your account. Nothing is uploaded.
What You Lose
Partial is fine. You can switch your contact and comment forms first and keep reCAPTCHA on a high-risk login until you trust the replacement.