Top reCAPTCHA Alternatives 2026: 8 Options Compared

Google reCAPTCHA is still the most widely deployed CAPTCHA, but the version most sites signed up for no longer exists. Since 2024 Google has moved every reCAPTCHA key into Google Cloud, the free allowance is 10,000 assessments a month, and since April 2026 the website owner, not Google, is the data controller for what the widget collects. Each of those changes has given teams a reason to look again.

This guide compares eight options: Prosopo Procaptcha, Cloudflare Turnstile, hCaptcha, Friendly Captcha, ALTCHA, MTCaptcha, Cap and captcha.eu, and explains when you need bot management rather than any CAPTCHA. We make Procaptcha, so weigh our view of it accordingly. Every competitor fact below links to the vendor's own page, checked on 2 November 2026.

Why teams leave reCAPTCHA

Every key now lives in a Google Cloud project

Google's migration overview sets out the timeline. New "Classic" keys stopped in the third quarter of 2024, Google began migrating the remaining Classic keys automatically in the fourth quarter of 2025, and from the first quarter of 2026 keys without a Google Cloud project lost API access. The automatic migration creates a Google Cloud project for you and emails ownership invitations. Your existing keys keep working, but you have to accept the invitation before you can change them.

For a site that added reCAPTCHA years ago with a personal Google account, this means a Google Cloud project, a Cloud console, Cloud terms and, above the free allowance, a Cloud billing account.

The free allowance is 10,000 assessments a month

Google's tier comparison lists three tiers:

Before April 2024 the free allowance was 1,000,000 assessments a month, so the free tier shrank by 99%. We cover that change in Google's reCAPTCHA price changes, and the reCAPTCHA pricing calculator works out a bill for your own volume.

The migration overview also explains what happens if you go over 10,000 without billing attached. siteverify requests fail open, returning success with a score of 0.9 and a quota error, while CreateAssessment requests fail closed with a 429 error. A site on the older siteverify integration therefore keeps accepting every submission, including bots, once it runs out of free assessments.

GDPR and cookies

From 2 April 2026, Google's reCAPTCHA FAQ says customers are "the sole data controller of Customer Data" and Google acts as a processor under the Cloud Data Processing Addendum. The same FAQ says the _GRECAPTCHA cookie "remains". France's data protection authority, the CNIL, still names reCAPTCHA in its cookie FAQ (question 17) as an example of a CAPTCHA whose provider reuses data for its own purposes, which means consent is required. We go through what the processor switch does and does not fix in Google reCAPTCHA is now a data processor, and score every vendor in this guide against GDPR in which CAPTCHAs are GDPR compliant.

Image challenges

reCAPTCHA v2 escalates to image-selection grids, with an audio alternative. Image grids are a barrier for blind and low-vision users, and both images and audio are what CAPTCHA-solving services sell answers to. reCAPTCHA v3 avoids the challenge entirely but only returns a score between 0 and 1, so you decide what to do with a low score and you build the fallback yourself.

reCAPTCHA alternatives compared

Prices are for each vendor's published plans. "Not published" means we could not find the fact on the vendor's own site.

The alternatives one by one

1. Prosopo Procaptcha: managed, cookieless, with a reason for every block

Procaptcha is a drop-in replacement for the reCAPTCHA widget. Most visitors pass an invisible behavioural check, and a suspected bot is escalated to a proof-of-work challenge, an image challenge or a jigsaw puzzle. The widget sets no cookies by default and does not build a profile of human visitors across sites. Prosopo is a UK company acting as a data processor under a published Data Processing Agreement.

Pricing: free for 10,000 requests a month on one site. Professional costs $39 a month for 100,000, $59 for 200,000, $99 for 500,000 and $139 for 1,000,000, with a 30-day free trial. Full details are on the pricing page.

Limits to know about: EU-only processing is an Enterprise and Custom feature, not part of Free or Professional. Self-hosting covers the open-source provider with proof-of-work and jigsaw challenges, while our detector, ML scoring and analytics stay on the managed plans.

Best for: teams who want a managed reCAPTCHA replacement with no cookie banner entry and a readable reason behind each block. The Procaptcha vs reCAPTCHA comparison goes into more detail.

2. Cloudflare Turnstile: free at any volume

Turnstile's plans page lists unlimited challenges on the free plan, limited to 20 widgets with 10 hostnames each and seven days of analytics. Enterprise raises those limits and removes Cloudflare branding. Cloudflare's launch post says Turnstile "never looks for cookies ... or uses cookies to collect or store information of any kind", and its privacy addendum says Cloudflare is a processor for bot detection but a controller, on legitimate interests, when it uses the signals to improve detection. Cloudflare is certified under the EU-US Data Privacy Framework.

Limits to know about: you get a pass or fail with no explanation of why a visitor failed.

Best for: sites already on Cloudflare for whom price is the deciding factor. Turnstile is the better choice there. See Turnstile alternatives for its weaker points.

3. hCaptcha: the familiar swap

hCaptcha's pricing page lists a free Basic plan, Pro at $139 a month (or $99 a month billed yearly) for 100,000 evaluations with $0.99 per 1,000 above that, and Enterprise on request. The low-friction passive mode is a Pro feature, and the fully passive no-CAPTCHA mode and risk scores are Enterprise only. Its GDPR page says hCaptcha acts as a processor, includes a DPA with Standard Contractual Clauses in its terms, and is enrolled in the EU-US, UK-US and Swiss-US Data Privacy Frameworks. Its privacy policy lists a first-party hmt_id cookie lasting 30 days.

Limits to know about: Basic users see image challenges more often, and hCaptcha does not offer an audio challenge, relying on an accessibility cookie and an optional text challenge instead.

Best for: teams who want the same integration shape as reCAPTCHA v2. We cover hCaptcha's GDPR position in hCaptcha GDPR concerns and the rest of the market in hCaptcha alternatives.

4. Friendly Captcha: German proof of work

Friendly Captcha uses proof of work and states "zero cookies, trackers, or personal data stored". Plans start at €9 a month for one domain and 1,000 requests, then €39 for 5,000 and €200 for 50,000, with a free plan for non-commercial sites. Its own EU endpoint guide explains that the default endpoint is global and may serve a request from outside the EU, and that the Germany-hosted endpoint needs an Advanced or Enterprise plan.

Limits to know about: the price per request is high at low volume, and EU-only processing starts at €200 a month.

Best for: EU sites that want a German vendor and can pay from day one. See Procaptcha vs Friendly Captcha.

5. ALTCHA: open source, MIT licence

The ALTCHA widget is MIT-licensed proof of work that "sets no cookies, does no fingerprinting, and shares no data with third parties". You can run it yourself for free, or pay for ALTCHA Cloud (EU-hosted, from €47 a month) or the self-hosted Sentinel server (from €99 a month). ALTCHA claims WCAG 2.2 AA conformance.

Limits to know about: the free version is proof of work only. It makes each request cost a little CPU time, which slows a spam run but does not tell a person from a bot.

Best for: developers who want no third party at all and can run the server side themselves. Our proof-of-work CAPTCHA guide explains what proof of work does and does not stop.

6. MTCaptcha: a cheap paid tier

MTCaptcha's pricing has a free plan of 10,000 evaluations a month on one domain, then Core at $29 a month for 300,000, Pro at $95 for 1,000,000 and Business at $170 for 2,000,000. Its GDPR page says IP addresses are anonymised and that it is certified under the EU-US, UK and Swiss-US Data Privacy Frameworks. It sets functional cookies, which it says are not used to profile visitors across sites.

Limits to know about: the free plan does not include the low-friction invisible mode, and we could not find where data is processed on MTCaptcha's own pages.

Best for: high-volume sites that want a low price per request from a managed service.

7. Cap: self-hosted proof of work that slows bots down but does not stop them

Cap is Apache-2.0 licensed and runs entirely on your own server, usually in Docker. It states "we don't use cookies or tracking and no data leaves your servers". There is no hosted version and no fee.

Cap does not tell bots from people. It makes every visitor's browser solve a proof-of-work puzzle, which costs a bot the same small amount of computing as it costs a person. Cap's own documentation says so: "Every CAPTCHA can eventually be solved" and "Cap's goal is to make automated abuse expensive and hard". With the default settings a script can compute the answer without a browser, and the project documents a solver for machine-to-machine use.

Cap also has optional "instrumentation" checks, which run a generated JavaScript program to confirm the answer came from a real browser, and a further switch that tries to block headless browsers. Both are off by default in Cap's standalone server. Even with them on, Cap's instrumentation page says undetected-chromedriver, nodriver and headless Firefox pass, and that "Instrumentation is not foolproof". In November 2026 a computer-use AI agent passed the widget with one click. Cap has no behavioural, IP reputation or device signals, so a bot running in a real browser is only slowed down by the proof of work.

Limits to know about: it raises the cost of spam but does not detect or block bots, and you run, patch and scale it yourself with no vendor support contract.

Best for: developers who want a free, open-source way to make low-value spam more expensive, and who do not need to stop a determined attacker.

8. captcha.eu: Austrian hosting

captcha.eu is hosted in Austria and says "no user data is collected and no cookies are set". Plans start at €8.90 a month (net of VAT) for one website and 1,000 requests, then €35.90 for 10,000 and €179.90 for 100,000. There is a 100-request trial rather than a free plan.

Limits to know about: its end-user privacy information mentions writing a cookie or local storage value, which does not match the homepage claim, so check with them before you rely on "no cookies" in your consent records.

Best for: European organisations that want a named, single-country processing location.

When a CAPTCHA is the wrong tool

A CAPTCHA protects the form you put it on. Bots that scrape product pages, call your API directly, hold checkout inventory or try stolen passwords against a login endpoint never load the widget, so no CAPTCHA in this list will see them. If that is your problem you need bot management, which checks every request at the edge. Prosopo Protect does this from £1,500 a month and includes Procaptcha for your forms. For the wider enterprise market, see DataDome alternatives and our breakdown of the Forrester Wave for bot management.

Choosing a reCAPTCHA alternative

• You are on Cloudflare and price is everything: Turnstile.
• You want open source on your own server: ALTCHA or Cap.
• You want a German or Austrian vendor: Friendly Captcha or captcha.eu, checking which plan gives EU-only processing.
• You want a managed, cookieless widget with a free tier and readable block reasons: Procaptcha.
• You want the lowest managed price per request at high volume: MTCaptcha.
• Bots reach your API and pages without touching a form: bot management, not a CAPTCHA.

For the wider market, read Best CAPTCHA.