Top Friendly Captcha Alternatives 2026: Prices Compared

Friendly Captcha is a German proof-of-work CAPTCHA. It has no image puzzles, it does not rely on tracking cookies, and it says it is WCAG 2.2 AA certified. People look for an alternative for one of three reasons: the price per request is high once a site grows past a few thousand submissions a month, EU-only processing is only on the €200-a-month Advanced plan, or form spam keeps getting through because proof of work prices an attack rather than detecting a bot.

This guide compares seven alternatives on those points: Prosopo Procaptcha, ALTCHA, Cap, Cloudflare Turnstile, hCaptcha, MTCaptcha and mCaptcha. Every price and claim below was checked on the vendor's own site on 2 November 2026 and is linked to its source.

Friendly Captcha's current prices

Friendly Captcha's published plans, in euros:

That works out at €9 per 1,000 requests on Starter, €7.80 on Growth and €4 on Advanced. For comparison, Procaptcha's Professional plan is $39 a month for 100,000 requests, and its free plan covers 10,000.

Proof of work is a price, not a test

Proof of work makes the visitor's browser solve a small computation before the form is accepted. The cost is negligible for one sign-up and adds up across a million attempts, so it works well against high-volume, low-value spam.

It does not tell you whether a person is present. Paying the cost is the whole protocol, so any bot that spends the CPU time passes, and for an attacker running credential stuffing, scalping or card testing, compute is cheap compared with the proxies they are already renting. Our explainer on PoW CAPTCHAs covers the failure modes in detail: GPUs that solve the puzzle far faster than a phone, solver APIs that accept a Friendly Captcha challenge as input, and a verdict that is only "solved" or "not solved".

Friendly Captcha v2 goes some way past pure proof of work. Its developer documentation says it analyses "various signals" to produce a risk score, and the score decides how hard the puzzle is, so a suspected bot gets a harder puzzle rather than a refusal. On Advanced and Enterprise, Risk Intelligence returns IP data, browser identification and bot-detection fields that your server can act on.

So the question to ask of each alternative is whether it detects automation, or only makes it cost more.

Friendly Captcha alternatives compared

The seven alternatives

1. Prosopo Procaptcha: proof of work with behavioural detection

Procaptcha uses proof of work as one layer and adds behavioural signals, so real visitors pass without seeing anything and suspected bots get a challenge. The free plan covers 10,000 requests a month on one site, and Professional costs $39 a month for 100,000 requests up to $139 a month for 1,000,000, with a bot score and the reason for every block. The widget is cookieless by default and built to meet WCAG 2.1 AA, and its first escalation is a proof-of-work challenge rather than an image. There is a free WordPress plugin.

Procaptcha's main limitation is that EU-only processing is on the Enterprise and Custom plans rather than Free and Professional. If EU-only processing is a hard requirement on a small budget, ALTCHA Cloud or a self-hosted option costs less.

Best for: sites that have outgrown Friendly Captcha's request limits or still get spam through it.

Full comparison: Procaptcha vs Friendly Captcha.

2. ALTCHA: open-source proof of work, with an EU cloud

ALTCHA is operated from the Czech Republic and describes itself as made and operated in Europe. Its core is MIT licensed, free, and runs proof of work on your own server. The paid products are ALTCHA Cloud, hosted in the EU with EU-only endpoints, at €47, €137 or €187 a month (the €47 plan allows about 1,000 API requests a day), and ALTCHA Sentinel, a self-hosted server from €99 a month. A WordPress plugin has a free plan and a Professional plan at €18.90 a month.

The open-source core has the same weakness as Friendly Captcha: it is proof of work only. The paid tiers add adaptive verification and threat intelligence.

Best for: teams that want EU hosting or self-hosting at a lower price than Friendly Captcha's Advanced plan.

3. Cap: free, self-hosted proof of work

Cap is Apache 2.0 licensed and free at any volume, with no per-request fee and no domain limit. You run it yourself, and Cap's own comparison with Friendly Captcha cites a small VPS as enough.

Cap makes a bot spend computing time, but it does not tell a bot apart from a person. Its own documentation says "Every CAPTCHA can eventually be solved" and that its goal is "to make automated abuse expensive and hard". Cap's optional instrumentation checks, which confirm the answer came from a real browser, are off by default, and its instrumentation page says undetected-chromedriver, nodriver and headless Firefox pass them anyway. In November 2026 a computer-use AI agent passed the widget with one click.

There is no hosted service and no vendor support, so you are responsible for keeping it running and up to date.

Best for: developers who would rather run a small server than pay per request, and who want spam to cost more rather than to stop bots.

4. Cloudflare Turnstile: free, with more than proof of work

Turnstile runs a series of small non-interactive JavaScript challenges, including proof of work, proof of space, probing for web APIs, and checks for browser quirks and human behaviour. It does not require your traffic to go through Cloudflare, and Cloudflare says it is WCAG 2.2 AA compliant. The free plan allows up to 20 widgets with 10 hostnames each.

The verdict is a pass or fail token with no reason attached, and Cloudflare is a US company. Our Turnstile alternatives guide covers both points.

Best for: a free invisible CAPTCHA with more signals than proof of work, where EU-only processing is not required.

5. hCaptcha: image challenges, free tier

hCaptcha has a free Basic plan and a Pro plan at $139 a month, or $99 a month billed yearly, for 100,000 evaluations and $0.99 per 1,000 above that. Pro adds a low-friction passive mode; a fully passive no-CAPTCHA mode is Enterprise only. For accessibility it offers a text challenge and an accessibility cookie.

Moving from Friendly Captcha to hCaptcha means moving back to visible image challenges for some visitors, and from a German vendor to a US one that processes data on regional servers worldwide. See hCaptcha GDPR concerns and hCaptcha alternatives.

Best for: sites that want a free tier and accept image challenges.

6. MTCaptcha: a large free tier and low prices per request

MTCaptcha is free for 10,000 evaluations a month on one domain. Core costs $29 a month for 300,000, Pro $95 for 1,000,000 and Business $170 for 2,000,000. Its low-friction invisible mode is on Core and above, not Free. It lists WCAG 2.1 AAA.

MTCaptcha does not publish where data is hosted on its pricing page, so ask before signing if you need EU processing.

Best for: high-volume forms on a tight budget.

7. mCaptcha: AGPL proof of work

mCaptcha is a proof-of-work CAPTCHA with an AGPL core and permissively licensed client libraries. It does not track or profile users and does not rate-limit by IP address. Its GitHub repository shows one release, v0.1.0, in March 2024, and the last commit in October 2025.

Best for: projects that require AGPL software and accept a small, slow-moving project.

When you need bot management instead of a CAPTCHA

A CAPTCHA protects the form you put it on. Bots that scrape your pages, call your API directly, hold checkout stock or test stolen passwords against a login endpoint never load the widget, so no CAPTCHA in this list will see them.

For that you need bot management, which checks every request to the pages and API you choose. Prosopo Protect starts at £1,500 a month (€1,750 or $1,990), includes Procaptcha for your forms, processes data only in the EU on request, and starts with 14 days in preview mode before it blocks anything. The enterprise vendors are compared in DataDome alternatives and Procaptcha vs Friendly Captcha sets out where Friendly Captcha sits against them.

How to choose

• Spam is low-volume and you want it free: Cap or ALTCHA's open-source core if you can run a server, Procaptcha, MTCaptcha or Turnstile if you cannot.
• You need EU-only processing on a small budget: ALTCHA Cloud, or self-host ALTCHA, Cap or mCaptcha.
• Spam still gets through proof of work: Procaptcha or Turnstile, because both look at the browser and behaviour.
• You need to know why a visitor was refused: Procaptcha Professional gives a reason for every block.
• Bots hit your API and pages, not only forms: bot management such as Prosopo Protect.
• Friendly Captcha's price and limits suit you, and spam is under control: stay where you are.