Editor Sebastiaan Smits ·
Published November 14, 2026 · Updated November 14, 2026
Site owners look past reCAPTCHA when the assessment meter starts to bill, when account protection needs a higher tier, or when they want a different data setup. Most move to Friendly Captcha, ALTCHA or Private Captcha for EU-operated options, or to Cloudflare Turnstile and hCaptcha for a hosted service.
Short answer: The closest replacements for reCAPTCHA in our CAPTCHA software ranking are Friendly Captcha, ALTCHA and Private Captcha. Choose Friendly Captcha if you want per-domain pricing and a vendor that can keep requests in EU data centers. The other 11 entries come from our Best CAPTCHA Software in 2026 list as well, and every one is set against reCAPTCHA specifically, with a note on the cases where reCAPTCHA should stay.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The first three alternatives go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow in their ranked order. How it works: placement disclosure · editorial process.
Premium is free to 10,000 assessments, then a flat $8 to 100,000, then $1.00 per 1,000. Google states the free allowance is per organization across all accounts and sites, so a busy or bot-inflated site can see the bill rise quickly.
Essentials covers bot defense only, with no password, account, SMS or transaction defense. Premium adds account defense and a Policy Engine limited to 3 rules. Enterprise requires a subscription with a minimum term of 12 months.
Google states that Classic site keys count as over quota above 1,000,000 calls a month for any domain, and that the key then stops being valid. Its own migration path leads to reCAPTCHA Enterprise, inside Google Cloud.
Ordered by how well each fits a team leaving reCAPTCHA; our own placement among 15 ranked products is in the last column.
| # | Alternative | Headquarters | Switch if | Our rank |
|---|---|---|---|---|
| 1 |  Friendly Captcha | Germany | you want per-domain pricing and a vendor that can keep requests in EU data centers | #1 |
| 2 |  ALTCHA | Czechia | you want to self-host the widget and keep the verification logic in your own stack | #2 |
| 3 |  Private Captcha | Estonia | you need requests processed in the EU and a small plan with many domains | #3 |
| 4 |  Cloudflare Turnstile | United States | you want a free hosted widget and short analytics history is enough | #4 |
| 5 |  hCaptcha | Not stated | you want a like-for-like swap with metered billing and a free entry plan | #5 |
| 6 |  MTCaptcha | Not stated | you prefer fixed monthly volume steps over a per-thousand meter | #7 |
| 7 |  Prosopo | Not stated | you want a free single-site start and may later buy site-based protection | #8 |
| 8 |  Cap | Not stated | you can run a container and want no vendor bill and no third-party requests | #9 |
| 9 |  mCaptcha | Not stated | you accept the AGPL license and want a free alternative that you operate yourself | #10 |
| 10 |  Arkose Labs | Not stated | you face organized fraud on specific journeys and want policy set by step | #11 |
| 11 |  Kasada | Not stated | you would rather remove the challenge entirely and buy a managed detection layer | #12 |
| 12 |  GeeTest | Not stated | you want behavior-based verification with device fingerprinting and a rules engine | #13 |
Charges per domain and by monthly requests, and the starter plan covers one domain with 1,000 requests. A self-hosted endpoint exists only on Enterprise, and EU-only dedicated data centers start on Advanced. Nothing here resembles a free 10,000-assessment allowance.
Switch from reCAPTCHA if you want per-domain pricing and a vendor that can keep requests in EU data centers.
The core widget is open source under the MIT license, so you can run it yourself. A hosted Cloud product is EU-hosted, and Sentinel is the self-hosted paid product. It is a toolkit to assemble, not a drop-in Google service with a console attached.
Switch from reCAPTCHA if you want to self-host the widget and keep the verification logic in your own stack.
Operated in the EU, and its site states that your data never leaves the EU. The entry tier is 1,000 requests with 50 domains included, and a self-hosting option is offered to high-security organizations. It has no free tier like Essentials.
Switch from reCAPTCHA if you need requests processed in the EU and a small plan with many domains.
A free plan with up to 20 widgets and a 7-day analytics lookback, so the cost question disappears for most sites. Enterprise is by contact sales, with up to 200 hostnames per widget and a 30-day lookback. It does not offer account defense tiers as such.
Switch from reCAPTCHA if you want a free hosted widget and short analytics history is enough.
Metered by evaluations, which is the closest model to what Google bills. Basic is free, Pro includes 100K evaluations then charges $0.99 per 1K, and Enterprise is by sales contact. The Pro price is lower when you pay annually.
Switch from reCAPTCHA if you want a like-for-like swap with metered billing and a free entry plan.
A free tier of 10,000 evaluations a month for one domain, then fixed monthly steps for 300,000, 1,000,000 or 2,000,000 evaluations. That ladder is easier to budget than a per-thousand meter, though the pages show dollars with no currency code.
Switch from reCAPTCHA if you prefer fixed monthly volume steps over a per-thousand meter.
Two products. Procaptcha has a free plan at 10,000 requests a month for one site, and a professional tier at 100K requests. Prosopo Protect Enterprise is priced by sites rather than requests and needs a 12-month term, which echoes Google's own Enterprise commitment.
Switch from reCAPTCHA if you want a free single-site start and may later buy site-based protection.
Apache 2.0 licensed and run as a single Docker container on your own infrastructure. It has no paid tier and no per-request fees. Its verification endpoint is stated to be compatible with reCAPTCHA, but client-side code still has to change.
Switch from reCAPTCHA if you can run a container and want no vendor bill and no third-party requests.
An AGPL v3 core, with a statement that it will always be free. The page lists no hosted pricing, so you operate it yourself. Its verification APIs are described as compatible with reCAPTCHA and hCaptcha, which eases a server-side swap.
Switch from reCAPTCHA if you accept the AGPL license and want a free alternative that you operate yourself.
Sells fraud and agent policy by population and journey step through Arkose Titan, not a drop-in widget. No price is published, and the calls to action are a Titan demo and a 7-day proof of value. Expect a sales process, not a signup form.
Switch from reCAPTCHA if you face organized fraud on specific journeys and want policy set by step.
One detection engine sold as Bot Defense, Account Intelligence, AI Agent Trust and Kasada IQ for Fraud. It says it stops attacks without CAPTCHAs, so it is a different layer from a challenge widget. No price is shown, only a demo request.
Switch from reCAPTCHA if you would rather remove the challenge entirely and buy a managed detection layer.
Its product line covers GeeTest CAPTCHA v4 behavior verification, Device Fingerprinting and a Business Rules Engine. No prices are published. The page offers Start Free Trial and Contact Sales, so a trial is possible before a quote is discussed.
Switch from reCAPTCHA if you want behavior-based verification with device fingerprinting and a rules engine.
Stay with reCAPTCHA if you already run Google Cloud, your volume sits under 10,000 assessments a month, and you want enterprise logging and dashboards at no cost. Premium suits mid-volume sites at a flat $8 up to 100,000 assessments. Switch only when billing, account defense tiers or data setup becomes the actual problem.
reCAPTCHA Enterprise verifies through an assessment endpoint that takes a token, a site key and an expected action. Classic uses siteverify. Alternatives use their own endpoints, so budget for changing both the front-end widget and the back-end check, and test with real form traffic.
The Google pages we read describe no log export format, destination or retention period, and the export-logs page returned an error. Take screenshots of dashboards and note your thresholds before you leave. Run both systems side by side first, as Google allows reCAPTCHA and Enterprise on one site.
We could not confirm any export route. The Google pages we read mention enterprise logging and dashboards in Essentials but state no export format, destination or retention period, and the export-logs page returned a 404.
Essentials has no commitment and Premium is monthly pay-as-you-go. Enterprise is a subscription with a minimum term of 12 months, so check your agreement before you plan a cutover. Terms beyond these labels are not on the pages we read.
Google states that pricing tiers adjust automatically with usage. Premium is free to 10,000 assessments, $8 flat to 100,000, then $1.00 per 1,000. Enterprise carries a fixed monthly commitment at $1 per 1,000.
We found no mention of self-hosting or on-premises deployment. It is presented as a Google Cloud service, part of Google Cloud Fraud Defense. Self-hosted options exist among the alternatives, such as ALTCHA, Cap and mCaptcha.
The token check on your server breaks first, because each vendor verifies through its own endpoint. Some alternatives state reCAPTCHA-compatible verification, but Cap says client code must still change. Mobile apps using the iOS or Android SDKs need a new SDK.
No, it is per organization. Google states the limit aggregates use across all accounts and all sites, so several small sites share one 10,000-assessment allowance.
Every price, plan limit and product statement about reCAPTCHA here was read on the vendors' own pages on November 14, 2026. Either can change at any time, so read the figures as of that day.
Sebastiaan Smits, Founder, wrote, edited and fact-checked this page.
Founder of The Interregnum and of 2 Steps Ahead, an AI search visibility agency. Editorially responsible for every page here; research and drafting are AI-assisted. Last reviewed November 14, 2026.
How we review.