Best reCAPTCHA Alternatives in 2026

Up to 10,000 assessments a calendar month, counted per organisation across all its accounts and sites. Past that, a project without billing gets a “Resource Exhausted (429)” error on every further check until the first day of the next month, and a project with billing moves to Premium prices: an $8 flat fee from 10,001 to 100,000 assessments a month, then $1 per 1,000. Google’s own pages disagree on whether the free tier needs a card: its tier comparison lists a valid billing instrument for Essentials, while its billing page says you need not enable billing. Without billing, a score takes one of four values (0.1, 0.3, 0.7, 0.9) with no reason codes.

By Google’s list prices in October 2026: nothing up to 10,000 assessments a month; on Premium an $8 flat fee up to 100,000 a month and then $1 per 1,000, so 50,000 assessments cost $8 and a million cost $908; on Enterprise $1 per 1,000 for a fixed monthly volume, with a 12-month minimum. Premium adds 11 score levels, basic reason codes, password leak checks (an extra assessment each) and up to three policy rules; Enterprise adds advanced reason codes and an account-takeover risk score.

For a commercial site, Cloudflare Turnstile: its free plan has unlimited challenges and up to 20 widgets, it works without your site being on Cloudflare, and its compatibility mode runs reCAPTCHA v2 code with few changes. hCaptcha’s free plan covers 10,000 requests a month but shows every visitor a challenge, and Friendly Captcha’s free plan is for non-commercial sites only. If the free tier’s limit is the only reason to move, compare the bill first: reCAPTCHA Premium is an $8 flat fee up to 100,000 assessments a month.

Both take reCAPTCHA v2 code with small changes. For Turnstile, load its script with ?compat=recaptcha, which registers it as grecaptcha and fills the g-recaptcha-response field, swap in your Turnstile site key, and have your server post the token to Turnstile’s Siteverify endpoint, which takes POST only where Google’s also takes GET. hCaptcha says its methods are API-compatible with reCAPTCHA v2 and that most people change three lines of code; its server endpoint is api.hcaptcha.com/siteverify. Neither replaces reCAPTCHA v3’s score: Turnstile answers success or failure, and an hCaptcha score is an Enterprise feature.

The W3C note on the inaccessibility of CAPTCHA prefers checks that ask the visitor nothing, because those pose no accessibility challenge. Turnstile in non-interactive or invisible mode, reCAPTCHA with score keys and Arkose Labs in transparent mode ask nothing; Friendly Captcha asks for one click by default, or nothing in non-interactive mode, and lists WCAG 2.2 AA; hCaptcha offers email verification and text challenges in over 100 languages. A server-side check such as Maskbreak shows nothing at all, which leaves you to decide what a visit it is unsure about gets instead of a puzzle.

It stops scripts that cannot solve it. It does not stop anyone who pays: on 27 October 2026 2Captcha listed reCAPTCHA v2 at €0.99 to €2.80 per 1,000 solves, reCAPTCHA v3 at €1.40 to €2.80 depending on the score, and Cloudflare Turnstile at €1.40. A pass also tells you nothing about the connection or the browser behind it, such as a residential proxy or a fake (antidetect) browser: those are read from the network and the device.

No vendor page can answer that for your site, this one included. The check runs Google’s code in your visitor’s browser and sends information about the visit to Google, so your privacy notice has to cover it, and your own data protection review decides whether you need consent first. If EU-only processing is a requirement, ask each vendor where it processes checks: Friendly Captcha, for one, lists dedicated EU-only data centres on its Advanced plan.

Yes, and it is the arrangement we would suggest. Screen every visit with the API, let allow answers through, refuse block answers, and show the challenge only to review answers, so the friction lands on the visits you were unsure about rather than on everyone.