reCAPTCHA Alternatives for Indie Developers (2026)

Short answer: For most indie developers, replace reCAPTCHA with Cloudflare Turnstile. It is free with unlimited challenges, it does not require your site to run behind Cloudflare, and it has a reCAPTCHA compatibility mode. If you need EU-only processing or want to self-host, choose Friendly Captcha (paid, from €9/month) or ALTCHA/Procaptcha (open source).

Every price and limit below comes from the vendor's own pricing or docs page, checked on 13 Nov 2026. The advice between the facts is ours and is labelled.

TL;DR#

• reCAPTCHA is no longer "free forever" at scale. Google's Essentials tier is free up to 10,000 assessments per calendar month per organization. Premium then charges an $8 flat fee up to 100,000 and $1 per 1,000 above that (Google compare tiers).
• Turnstile is the default swap. Free plan: unlimited challenges, up to 20 widgets, 10 hostnames per widget, WCAG 2.2 AAA listed on both plans (Turnstile plans).
• hCaptcha has a free Basic plan; Pro is $139/month monthly or $99/month yearly for 100K evaluations (hCaptcha pricing).
• Privacy-first paid options: Friendly Captcha (from €9/month), CaptchaFox (from €15/month), MTCaptcha (free up to 10,000 evaluations, Core $29/month).
• Self-host: ALTCHA (MIT) and Procaptcha (Apache-2.0).
• A widget is not a strategy. Verify tokens on the server, and add a honeypot, rate limits and email verification.

Disclosure: ZeroRaised is a launch site for bootstrapped products. We have no commercial relationship with any vendor in this post and earn nothing if you sign up. Facts come from the linked pages as checked on 13 Nov 2026.

Who this guide is for#

You run a small app and need to stop bots on a signup form, a login page, a contact form, a waitlist or a free-trial signup. This is a buyer's guide to the bot-check widget itself. If your real problem is people farming free trials, read our guide on how to prevent free trial abuse first: it covers usage caps, disposable email blocklists and where Turnstile fits in that stack, and we will not repeat it here.

Why indie developers are leaving reCAPTCHA#

Three reasons come up, and two of them are on Google's own pages.

1. The free tier has a ceiling. Google's tier page lists Essentials as "Free up to 10,000 assessments per calendar month", and a footnote says the allowance is per organization and pooled across all accounts and sites (Google compare tiers). Two busy side projects under one Google organization share that 10,000.
2. Keys now live in Google Cloud. Google's migration overview says new Classic keys stopped in Q3 2024, automated migration began in Q4 2025, and Q1 2026 was set to "Complete automated migration. API access locked for keys without a Google Cloud project" (Google migration overview). The same page says usage over 10,000 assessments a month requires billing on your Google Cloud project.
3. Privacy review. For EU-facing products, a Google script on every form is one more processor to justify. Our read: this is often the real trigger, not price.

reCAPTCHA alternatives at a glance#

Sources: Google, Turnstile plans, Turnstile docs, hCaptcha pricing, Friendly Captcha, ALTCHA pricing, MTCaptcha pricing, Procaptcha pricing, CaptchaFox pricing, AWS WAF pricing.

The options in detail#

Cloudflare Turnstile: the default pick#

Turnstile runs "a series of small non-interactive JavaScript challenges to gather signals about the visitor or browser environment" and only shows a checkbox when it judges the visitor risky. You choose between managed, non-interactive and invisible widgets, and it "can be embedded into any website without sending traffic through Cloudflare" (Turnstile docs).

The free plan gives you up to 20 widgets, 10 hostnames per widget, 7 days of analytics and unlimited challenges; Enterprise adds unlimited widgets, up to 200 hostnames per widget, ephemeral IDs and branding removal (Turnstile plans). Both plans list WCAG 2.2 AAA compliance.

On data, Cloudflare's Turnstile privacy notice says the signals it collects are "strictly necessary for the purpose of detecting and blocking bots" and that their purpose "is not to identify, profile or target any individuals" (Turnstile privacy addendum).

Our read: unless you have a specific reason to pick something else, start here. It costs nothing at any indie scale.

hCaptcha#

hCaptcha Basic is free. Pro costs $139/month billed monthly or $99/month billed yearly, includes 100K evaluations a month, charges $0.99 per 1K over, and adds "Low Friction 99.9% Passive Mode", custom themes and analytics, with a 14-day trial. Enterprise adds risk scores and is sales-led (hCaptcha pricing).

Its docs say "hCaptcha methods are API-compatible with reCAPTCHA methods", which makes migration mostly a search and replace (hCaptcha docs). On accessibility, hCaptcha says it believes it is "compliant with WCAG 2.2 AA based on our own testing and external accessibility reviews", offers a text-based challenge that sites may enable, and an accessibility cookie for registered users. It also says audio challenges are not currently offered (hCaptcha accessibility).

Our read: on the free plan your users may see image challenges, since passive mode is listed on Pro. Fine for a contact form, more friction on signup.

Friendly Captcha#

Friendly Captcha "generates a unique crypto puzzle for each user's device" and solves it in the background while the user fills in the form. It advertises "Zero cookies, trackers, or personal data stored from your users" and claims WCAG 2.2 AA (Friendly Captcha).

Plans, billed monthly in euros: a free plan for non-commercial, low-traffic sites (1 domain, 1,000 requests/month); Starter €9/month (1 domain, 1,000 requests); Growth €39/month (5 domains, 5,000 requests); Advanced €200/month (50 domains, 50,000 requests, dedicated data centres such as EU-only); Enterprise custom with a self-hosted endpoint option.

Our read: excellent for an EU-facing B2B product with modest form traffic. The request allowances are small, so price it against your real signup volume.

ALTCHA#

ALTCHA is a proof-of-work widget with an MIT-licensed core you can self-host for free (ALTCHA on GitHub). The repo says it is "Fully GDPR compliant and cookie-free" and "Engineered to exceed WCAG 2.2 AA standards"; by default the payload goes in a hidden form field. Paid options exist if you do not want to run it: ALTCHA Cloud from €47/month, and Sentinel (self-hosted, with more features) from €99/month, both excluding VAT (ALTCHA pricing). ALTCHA Cloud is described as "hosted in the EU without data sharing or data transfers."

Our read: the best zero-vendor option if you are comfortable adding a small challenge endpoint to your own backend.

MTCaptcha#

MTCaptcha's free plan gives 10,000 captcha evaluations a month on 1 domain, aimed at "personal sites and testing", and excludes the low-friction invisible captcha. Core is $29/month ($25/month billed yearly) for 300,000 evaluations; Pro $95/month for 1,000,000; Business $170/month for 2,000,000. Development domains do not count against domain limits. It lists WCAG compliance and GDPR compliance on every plan (MTCaptcha pricing).

Prosopo Procaptcha#

Procaptcha's free plan includes 10,000 requests a month ("one verification per form submission"), 1 site and three challenge types: proof of work, image and jigsaw. Professional starts at $39/month up to 100K requests and tops out at $139/month for 1M, with 15% off yearly (Procaptcha pricing). The GitHub repo is Apache-2.0 and says you can run it self-hosted; it notes the client-side detection library used by the "frictionless" type is not Apache-2.0, while the pow and puzzle types need nothing closed-source.

CaptchaFox#

CaptchaFox has no permanent free plan, only a one-time 7-day trial. Starter is €15/month for 10,000 requests and 2 domains; Growth €39/month for 30,000; Team €85/month for 100,000. It says it does not use cookies or trackers, lists EU hosting, and says it will not shut you down for occasional spikes but will contact you to upgrade (CaptchaFox pricing).

AWS WAF CAPTCHA#

If you already run on AWS behind CloudFront or an ALB, AWS WAF can serve a CAPTCHA puzzle at the edge. AWS's pricing page gives $0.40 per thousand CAPTCHA attempts in its worked example, on top of WAF's $5.00/month per web ACL, $1.00/month per rule and $0.60 per million requests (AWS WAF pricing). Our read: it only makes sense if you are on WAF anyway.

Non-CAPTCHA layers you should add anyway#

None of these replaces a widget on a high-value form, but each is free and stops a different kind of bot:

• Honeypot field. A hidden input that humans never fill. Reject any submission where it has a value. It catches the laziest form spammers with zero user friction.
• Rate limiting. Limit attempts per IP and per account on login and signup. This is the main defence against credential stuffing, where a CAPTCHA alone just slows attackers down.
• Email verification. Do not activate accounts or send onboarding sequences until the address is confirmed.
• Server-side checks. Validate the token on every request, check the hostname and action in the response, and reject reused tokens.

Our vibe-coded app security checklist covers rate limits and other basics if you shipped fast and want a quick audit.

Decision guide by situation#

This is our editorial advice based on the facts above.

For the GDPR side, our GDPR checklist for solo SaaS founders explains how to list processors like a CAPTCHA vendor in your privacy policy. Not legal advice.

Worked example: 30,000 form verifications a month#

Illustrative arithmetic only, using the published prices above. Units differ by vendor (assessments, evaluations, requests), so treat this as a rough comparison.

Our read: at indie volumes, price is rarely the deciding factor. Friction for real users, privacy posture and how much you want to run yourself matter more.

How verification works (any vendor)#

Every widget here follows the same pattern:

1. The widget runs in the browser and puts a short-lived token in a hidden form field.
2. Your server receives the form and POSTs the token plus your secret key to the vendor's verify endpoint.
3. You accept the form only if the response says success.

The official verify endpoints:

• reCAPTCHA: https://www.google.com/recaptcha/api/siteverify (tokens valid for two minutes, verifiable once) (Google verify docs)
• Turnstile: https://challenges.cloudflare.com/turnstile/v0/siteverify (tokens valid for 300 seconds, intended for single use) (Turnstile server-side validation)
• hCaptcha: https://api.hcaptcha.com/siteverify, form-encoded (hCaptcha docs)
• Friendly Captcha v2: https://global.frcapi.com/api/v2/captcha/siteverify, with an X-API-Key header (Friendly Captcha verify docs)

A generic server-side check in Node (Turnstile shown; swap the URL and field names for others):

async function verifyCaptcha(token, ip) {
  const body = new URLSearchParams({
    secret: process.env.CAPTCHA_SECRET,
    response: token,
    remoteip: ip,
  });
  const res = await fetch(
    "https://challenges.cloudflare.com/turnstile/v0/siteverify",
    { method: "POST", body }
  );
  const data = await res.json();
  return data.success === true && data.hostname === "yourapp.com";
}

Two mistakes we see often: checking the token only in the browser (bots skip your JavaScript entirely), and failing open when the verify call errors. Decide deliberately what happens on a timeout. Note that Google's own migration page says SiteVerify requests that exceed quota "will fail open" (Google migration overview), which is one more reason to watch the 10,000 limit.

Migrating from reCAPTCHA in an afternoon#

1. Pick the replacement from the decision guide and create a sitekey and secret in its dashboard. Add your localhost and staging hostnames.
2. Swap the client script. For Turnstile, Cloudflare's guide says load https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha; compatibility mode registers the API as grecaptcha and keeps the g-recaptcha-response field name. Replace the sitekey in your grecaptcha.render() calls (Turnstile reCAPTCHA migration). For hCaptcha, its API is reCAPTCHA-compatible, so the change is similar.
3. Swap the server verify URL and secret. Turnstile only accepts POST with a form or JSON body, not reCAPTCHA-style GET query parameters.
4. Check version limits. Cloudflare says its compatibility is "currently compatible up to reCAPTCHA v2". If you rely on v3 scores, rewrite that logic as a pass/fail check plus your own rate limits.
5. Ship behind a flag, watch form completion and spam for a week, then delete the old keys and remove Google from your privacy policy's processor list if nothing else uses it.
6. Test with a real screen reader and a mobile browser before you call it done.

Frequently asked questions#

What is the best free reCAPTCHA alternative?#

For most indie developers, Cloudflare Turnstile. Its free plan includes unlimited challenges, up to 20 widgets with 10 hostnames each, all widget types and pre-clearance, and Cloudflare says it can be embedded on any website without routing traffic through Cloudflare. hCaptcha Basic and MTCaptcha Free (10,000 evaluations a month) are other free options.

Is reCAPTCHA still free?#

Partly. Google's compare-tiers page says the Essentials tier is free up to 10,000 assessments per calendar month, counted per organization across all accounts and sites. Above that you need the Premium tier with a billing account: an $8 flat fee from 10,001 to 100,000 assessments, then $1 per 1,000.

Which CAPTCHA is best for GDPR?#

Vendors that say they set no cookies and process data in the EU are the easiest to justify. Friendly Captcha says it uses no cookies and stores no personal data, with EU-only data centres on its Advanced plan. ALTCHA Cloud says it is hosted in the EU, and ALTCHA or Procaptcha self-hosted keep verification on your own servers. These are vendor claims, not legal advice.

Can I switch from reCAPTCHA to Turnstile without rewriting my code?#

Mostly. Cloudflare's migration guide says loading the Turnstile script with ?compat=recaptcha registers the API as grecaptcha and keeps the g-recaptcha-response field name. You swap the sitekey and change the server verify URL. Cloudflare says this is compatible up to reCAPTCHA v2, so v3 score-based setups need more work.

Is a CAPTCHA enough to stop fake signups?#

No. A widget raises the cost of automated form posts, but you still need server-side token verification, rate limiting, email verification and, for free trials, abuse controls such as usage caps. Our guide on preventing free trial abuse covers those layers.

Protect the form, then launch#

Once your signup form is bot-proof, run through our product launch checklist for bootstrapped makers, then launch on ZeroRaised, the directory for products built without institutional VC. For more no-nonsense tool comparisons, join the ZeroRaised newsletter.

Sources#

All last checked 13 Nov 2026.

• Google reCAPTCHA: compare tiers
• Google reCAPTCHA: migration overview
• Google reCAPTCHA: verifying the user's response
• Cloudflare Turnstile documentation
• Cloudflare Turnstile plans
• Cloudflare Turnstile server-side validation
• Cloudflare Turnstile migration from reCAPTCHA
• Cloudflare Turnstile privacy addendum
• hCaptcha pricing
• hCaptcha developer docs
• hCaptcha accessibility
• Friendly Captcha homepage and plans
• Friendly Captcha verify docs
• ALTCHA pricing
• ALTCHA on GitHub
• MTCaptcha pricing
• Prosopo Procaptcha pricing
• Prosopo captcha on GitHub
• CaptchaFox pricing
• AWS WAF pricing