reCAPTCHA Alternatives in 2026: Real Prices and What I Actually Use

For over a year, this post recommended a product called "Gymnastics styles".

That's Cloudflare Turnstile. The English version was machine-translated from my German text, and the software read "Turnstile" as the German words Turn and Stile. Google crawled the page on both of my domains and left it out of the index both times. Fair enough.

So I threw the old version out. It warned that reCAPTCHA would move to the cloud "by the end of 2025", and that move is finished. This is what changed, what the reCAPTCHA alternatives cost today, and what I run on my own forms. Every price below comes from the vendor's own page on 6 November 2026.

What actually happened to reCAPTCHA

Google moved Classic keys into Google Cloud projects between Q4 2025 and Q1 2026. Existing v2 and v3 site keys kept working without code changes, which is why plenty of site owners never noticed.

The keys stayed the same. The deal around them didn't.

The free tier is 10,000 assessments a month, counted per organization across all your sites. Above that you pay a flat $8 up to 100,000 assessments, then $1 per 1,000.

Going over without billing fails open. If you pass the quota with no billing account, SiteVerify requests return success:true with a score of 0.9, plus an error message in the response. Google did this so real users don't get locked out. But if your code only reads success and the score, your bot protection just waved everyone through and nothing on your site tells you. (The newer CreateAssessment call fails closed with a 429 error instead.)

Since 2 April 2026 you're the sole data controller. Google's FAQ says customers are "the sole data controller of Customer Data". Google's Privacy Policy and Terms links dropped off the badge, and the _GRECAPTCHA cookie stays. Google now acts as your processor, which sounds like good news for GDPR. It also means your privacy notice and your legal basis are entirely your problem.

Then on 22 April 2026, reCAPTCHA became part of Google Cloud Fraud Defense. Same product, new name on the invoice.

If you run a US site under 10,000 assessments, none of this forces you to leave. Set up billing or watch the quota. If you're in the EU, or you just don't want a Google cookie on your contact form, keep reading.

Five reCAPTCHA alternatives with current prices

Money isn't the reason to switch: Google's $8 for up to 100,000 assessments beats every paid plan below at that volume. You switch for privacy reasons: the cookie, and the fact that the paperwork is now yours.

Tool	How it works	Free option	Paid from	Where data goes
ALTCHA	Proof-of-work, self-hosted	Yes, MIT license	€47/mo (hosted)	Your server, or EU-hosted cloud
Cloudflare Turnstile	Browser signals, usually invisible	Yes, unlimited challenges	Enterprise on request	Cloudflare, a US company
Friendly Captcha	Background puzzle plus risk signals	Non-commercial only	€9/mo (1,000 requests)	EU, per the vendor
hCaptcha	Image challenges on the free plan	Yes	$99/mo (100,000 evaluations, annual)	United States, per its privacy policy
MTCaptcha	Adaptive invisible plus proof-of-work	Yes, 10,000 a month	$29/mo (300,000 evaluations)	Not named on its site

Apart from ALTCHA, everything below comes from vendor docs and price pages rather than numbers of my own.

ALTCHA: what I run on my own forms

My static Astro sites post to one shared form backend, and that backend runs self-hosted ALTCHA: SHA-256 proof-of-work, plus a honeypot, plus rate limiting. I wrote up the whole contact form setup, including the widget and server version mismatch that ate an afternoon.

The core is free and MIT licensed. ALTCHA says it sets no cookies and does no fingerprinting, and with self-hosting there's no third party in the request at all, which fits how I think about self-hosting in general. If you don't want to run it, ALTCHA Cloud starts at €47 a month for 3 sites and a soft limit of 15,000 verifications. The self-hosted Sentinel platform starts at €99 a month.

Proof-of-work makes spam expensive, and it doesn't judge intent. For a contact form that's the right amount of defense. I have not run it on a login or a checkout, so take this as reasoning rather than a measurement, but that's where I'd want risk scoring on top.

Cloudflare Turnstile: the free default

Free with unlimited challenges, up to 20 widgets and 10 hostnames per widget. It doesn't need Cloudflare's CDN, and in Managed mode visitors only see a checkbox when their risk warrants it. If you wonder how that stays free, I went through what Cloudflare is actually selling.

The old version of this post called it cookie-free and left it there. The privacy picture has more to it. Cloudflare's Turnstile notice lists IP address, TLS fingerprint, User-Agent and sitekey as the signals. Cloudflare is your processor for bot detection and a controller when it uses those signals to improve Turnstile. The notice says nothing on retention or transfers, and the optional Pre-Clearance feature does issue a cookie.

Turnstile also scores whether a session looks normal, which can trip up real customers using AI agents.

Friendly Captcha: the EU vendor, at a price

The browser solves a cryptographic puzzle in the background, and risk signals set the difficulty. The docs say it doesn't rely on tracking or cookies and offer "a true EU-only offering".

Starter is €9 a month for 1,000 requests on one domain. Growth is €39 for 5,000 requests on five domains, Advanced €200 for 50,000 on fifty. Non-commercial use is free. Per request it's the most expensive option in this post by a wide margin, so what you're buying is an EU vendor your legal team can sign off.

The first version of this post named it the leading alternative, based on "case studies" I can't produce, and said it's hosted in Germany. The vendor says EU, so I'm saying EU.

hCaptcha: fine if you're okay with image puzzles

The free plan is a classic CAPTCHA where most users see a challenge. Pro starts at $99 a month on annual billing ($139 monthly) with 100,000 evaluations, then $0.99 per 1,000.

It's run by a US company, and its privacy policy says personal data is transferred to the United States, under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. hCaptcha believes its anti-bot cookies are exempt from consent. That's their reading, and you'd have to be comfortable with it.

MTCaptcha: the cheapest paid volume

10,000 evaluations free on one domain, then $29 a month for 300,000, $95 for a million, $170 for two million. On the numbers it's the cheapest paid option here.

The old post described it as a text puzzle and said it wasn't strong enough for high-traffic sites. I can't find anything backing that up, so it's gone. Its homepage now sells adaptive invisible checks plus proof-of-work, lists Data Privacy Framework certification, and doesn't name its hosting locations.

GDPR: "compliant" is your job under all five

Vendors love the phrase "GDPR compliant". A tool can't be compliant on your behalf. You still need the entry in your processing records, a documented legal basis, a privacy notice that names the vendor and, unless you self-host, a data processing agreement.

Consent is where it gets uncomfortable. Austria's Federal Administrative Court ruled in September 2024 against a site that ran reCAPTCHA cookies without consent. After Google's role change, the German law firm Scheja and Partners concluded that a consent requirement under § 25 TDDDG "must generally be assumed". Others are more relaxed and say legitimate interest can work, while calling consent the safest route. I didn't find a court decision on the new setup or a statement from the German regulators, so this stays open. I'm a developer, ask your lawyer.

The practical trap is simple logic: if your CAPTCHA needs consent and a visitor declines, you either show an unprotected form or no form. A tool that sets no cookies and keeps data in the EU sidesteps most of that fight, which is the main reason ALTCHA and Friendly Captcha exist on this list.

Accessibility belongs in the decision

WCAG 2.2 added Accessible Authentication at level AA. On a login, a cognitive test like a puzzle isn't allowed unless there's an alternative, a helper mechanism, or the test is recognizing objects. A contact form isn't authentication, but your login is.

Vendors all claim conformance: Turnstile and ALTCHA say WCAG 2.2 AA, MTCaptcha says 2.1 AAA. These are self-reported. hCaptcha is the most candid: it believes it meets 2.2 AA, tells you to evaluate your own deployment, and admits visual challenges "cannot be fully accessible". Its accessibility route needs an email signup and a cookie. Test your form with a keyboard and run a WCAG checker over it either way.

Which reCAPTCHA alternative I'd pick

For a plain contact form I'd start with ALTCHA. The rest depends on what sits behind the form.

• Contact form, and you control the backend: self-hosted ALTCHA, because that's what I run.
• You want it free and don't want to host anything: Turnstile, if you've read its privacy notice and can live with it.
• Legal or procurement wants an EU vendor: Friendly Captcha, if your volume fits the plans.
• High volume on a budget: MTCaptcha, going by the price list.
• US site under 10,000 assessments, already on reCAPTCHA: stay, sort out billing, and check how your code handles that quota error.

Whichever one you pick needs server-side verification, so a purely static form with no backend isn't an option for any of them. And don't let a CAPTCHA carry the whole job. A honeypot and a rate limit stop a lot before the CAPTCHA has to do anything, though LLM-driven agents will happily fill in your honeypot.

Swapping the widget is the easy part. Updating your privacy notice is what people forget. If your forms need more than a swap, I build this kind of thing.