Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The largest vendors in CAPTCHA software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 15 tools, reviewed
#1 Friendly Captcha
Privacy-first proof-of-work CAPTCHA with euro pricing · Germany · friendlycaptcha.com
Proof-of-work EU data centers Published prices
Friendly Captcha takes first place because a small team can read its pricing, understand what a request is, and be running in an afternoon. Verification happens in the background with proof-of-work and risk signals, so visitors label no images.
- Pricing: Per month, by domains and requests. Starter €9 per month, Growth €39, Advanced €200, Enterprise custom; 30-day trial on paid plans; free for non-commercial use. Free plan: free plan.
- Best for: Privacy-minded sites with modest traffic
- Strengths: Proof-of-work and risk signals; Background verification without image labeling; Usage statistics.
Where it falls short
The meter is tight at the bottom: Starter covers one domain and 1,000 requests a month, Growth five domains and 5,000, so a busy shop climbs plans quickly.
Wrong for
Companies that need account-takeover and fraud analytics across logins and checkout, or that run millions of verifications a month and want a single flat contract.
Visit Friendly Captcha →
#2 ALTCHA
Open-source, privacy-first CAPTCHA with optional hosted tiers · Czechia · altcha.org
Open source MIT license GDPR-minded
ALTCHA gives a buyer three ways in: embed the MIT widget for nothing, pay for the Cloud service with EU-only endpoints, or add Sentinel when adaptive protection is needed. The homepage states that the open-source widget has no usage limits, which removes the per-request anxiety of hosted rivals.
- Pricing: Open source + paid tiers. Widget free. Free plan: open source.
- Best for: Developers who want free code or cheap hosting
- Strengths: No tracking; GDPR compliant; WCAG 2.2 AA accessible.
Where it falls short
The free widget leaves verification and abuse handling to your own code, so the saving is engineering time. Four products with four trial lengths make comparison slightly fiddly.
Wrong for
Teams without a developer who can wire up server-side verification, and buyers who need fraud scoring on logins and payments.
Visit ALTCHA →
#3 Private Captcha
EU-hosted CAPTCHA priced by request tier · Estonia · privatecaptcha.com
EU-hosted Request tiers Self-hosting
Private Captcha is built for the agency that protects many client forms and wants one bill.
- Pricing: Per month, by request tier. €5 per month or €60 per year excluding VAT for the 1,000-request tier, rising through tiers to 1,000,000 requests. Free plan: free trial.
- Best for: European agencies protecting client forms
- Strengths: Smart difficulty scaling; EU-only endpoints; Scraping protection.
Where it falls short
There is no permanent free plan, only a 14-day trial, so hobby projects pay from day one. Prices exclude VAT.
Wrong for
Non-commercial sites with almost no traffic, where a free plan is enough, and enterprises that need mobile SDKs and account-level fraud signals.
Visit Private Captcha →
#4 Cloudflare Turnstile
Free, non-interactive CAPTCHA replacement from Cloudflare · United States · cloudflare.com
Free tier Non-interactive WCAG 2.2 AAA
Turnstile is the default free answer for a form that merely needs to keep scripts out. Cloudflare's plans page lists unlimited challenges on both plans, so a growing site does not hit a request meter, and the product page claims WCAG 2.2 AAA compliance.
- Pricing: Free + Enterprise (quote). Free plan with up to 20 widgets and 10 hostnames per widget; Enterprise on contact sales; both list unlimited challenges. Free plan: free plan.
- Best for: Sites wanting a free check without puzzles
- Strengths: Non-interactive challenge; Pre-clearance support; WCAG 2.2 AAA compliance.
Where it falls short
The Free plan stops at 20 widgets, 10 hostnames per widget and seven days of analytics.
Wrong for
Agencies hosting many client domains under one account, firms that must keep analytics for months, and buyers wanting EU-only processing promises.
Visit Cloudflare Turnstile →
#5 hCaptcha
Bot protection with free Basic and published Pro plans · Not stated · hcaptcha.com
Free plan Passive mode Published pricing
hCaptcha is the most direct swap for a site leaving reCAPTCHA: three plans, a free Basic tier and a Pro plan whose price and overage rate are published to the cent.
- Pricing: Per month + usage overage. Basic free. Free plan: free plan.
- Best for: Teams replacing reCAPTCHA on a budget
- Strengths: Passive (No-CAPTCHA) mode; Risk scores; Analytics.
Where it falls short
The jump from free to $99 a month is wide, and the pricing page shows dollars only, with no euro price. After the 14-day trial, users fall back to Free.
Wrong for
Very small sites that cannot justify $99 a month once Basic limits bite, and buyers wanting EU-only processing stated on the page.
Visit hCaptcha →
#6 reCAPTCHA
Google Cloud's CAPTCHA and fraud scoring service · United States · cloud.google.com
Google Cloud Risk scoring Mobile SDKs
reCAPTCHA remains the product other CAPTCHAs are compared with, and Google's tier table shows why a security team still picks it: bot defense at 4 or 11 levels, iOS and Android SDKs, a policy engine, and account and transaction defense in higher tiers.
- Pricing: Per assessment, three tiers. Essentials free up to 10,000 assessments a month. Free plan: free plan.
- Best for: Sites already running on Google Cloud
- Strengths: Network bot defense; Enterprise bot defense; Visual bot challenges.
Where it falls short
Even the free tier requires a valid Google Cloud billing instrument. The 10,000 free assessments are shared across the whole organization.
Wrong for
Small sites without a Google Cloud account, and privacy-led European sites that want the vendor out of the data path.
Visit reCAPTCHA →
#7 MTCaptcha
Adaptive invisible CAPTCHA with a free plan · Not stated · mtcaptcha.com
Free plan Invisible Accessibility
MTCaptcha suits a site that wants an invisible check, a free tier with a clear ceiling, and a compliance sheet to hand to a procurement team. The homepage lists WCAG, Section 508 and EN 301 549 support, SAML 2.0 single sign-on, an admin REST API and eleven preset themes.
- Pricing: Per month, by verifications. Free plan up to 10K verifications per month; paid plan from $29 per month, currency shown as dollars only. Free plan: free plan.
- Best for: Small sites needing accessibility statements
- Strengths: Adaptive invisible NoCAPTCHA; Adaptive risk engine; Enterprise dashboards.
Where it falls short
The homepage names Sun Spray Technologies LLC but no address or country, and shows a single paid price with few details of what changes between plans.
Wrong for
Buyers who need a stated EU data location or an open-source codebase to audit.
Visit MTCaptcha →
#8 Prosopo
Open-source base captcha plus enterprise bot protection · Not stated · prosopo.io
Open-source base Free tier Enterprise add-on
Prosopo is two products under one roof. Procaptcha is the form captcha, free for 10,000 requests a month and then from $39, with invisible and accessible modes.
- Pricing: Per month, two products. Procaptcha free for 10,000 requests a month, then from $39. Free plan: free plan.
- Best for: Teams that want a free captcha now, Protect later
- Strengths: Procaptcha; Prosopo Protect; Invisible CAPTCHA.
Where it falls short
Protect starts at $1,990 a month on a 12-month term, a long way from the $39 Procaptcha tier. Enterprise support runs 09:00 to 17:30 UK time.
Wrong for
Shops that need round-the-clock support in several time zones, or teams who want a known open-source license before adopting.
Visit Prosopo →
#9 Cap
Open-source, self-hosted proof-of-work CAPTCHA · Not stated · capjs.js.org
Open source Apache 2.0 Docker
Cap is for the developer who would rather run a container than rent a service. It ships under Apache 2.0, runs as a single Docker image, and its siteverify API follows the reCAPTCHA and hCaptcha shape, so server code can stay.
- Pricing: Open source (self-hosted). Free; the page states there is no paid tier holding features back and no per-request fees. Free plan: open source.
- Best for: Developers hosting everything themselves
- Strengths: HashWX proof-of-work; Instrumentation challenges; Rules.
Where it falls short
The client code must still be swapped for Cap's widget. You carry uptime, upgrades and abuse tuning yourself.
Wrong for
Teams that need a vendor contract, a support line or a compliance questionnaire answered.
Visit Cap →
#10 mCaptcha
Free-software proof-of-work CAPTCHA you host yourself · Not stated · mcaptcha.org
Open source AGPL v3 Self-hosted
mCaptcha is the copyleft option: the core is AGPL v3, client libraries use free-software licenses, and the homepage says it does not track or profile users. Proof-of-work replaces image puzzles, and compatible APIs for reCAPTCHA and hCaptcha mean a migration can be a change of endpoint.
- Pricing: Open source (self-hosted). Free; the project says it will always be free. No usage or capacity limits stated on the page. Free plan: open source.
- Best for: Self-hosters wanting copyleft software
- Strengths: Privacy focused; Proof-of-work; Libre software.
Where it falls short
The homepage is the only source we read, and it gives no release history, support channel or maintainer, so we could not judge how actively it is kept up.
Wrong for
Companies that cannot spend engineer time on upkeep, or need guaranteed maintenance.
Visit mCaptcha →
#11 Arkose Labs
Enterprise bot and fraud platform sold by demo · Not stated · arkoselabs.com
Enterprise Account protection Quote only
Arkose Labs is built for platforms where fake accounts and takeover attempts cost real money. Its homepage lists a suite: Bot Manager, Device ID, Email Intelligence, Phishing Protection, Scraping Protection and an Agent Trust Manager for automated agents, all managed from a Command Center.
- Pricing: Quote only. No price published; the calls to action are a Titan demo and talking to experts. Free plan: none.
- Best for: Large consumer platforms facing account abuse
- Strengths: Arkose Titan; Bot Manager; Agent Trust Manager.
Where it falls short
No price, no free plan and no self-serve path. A guided 7-day proof of value is mentioned, but not described as a free trial.
Wrong for
Sites protecting a contact form or newsletter sign-up, and any team without a security analyst to run it.
Visit Arkose Labs →
#12 Kasada
Web and API bot defense sold through a demo · Not stated · kasada.io
Enterprise API defense Quote only
Kasada targets organizations whose problem is automation at scale: scraping, account takeover and fraud against websites and APIs. The homepage names four products, Bot Defense, Account Intelligence, AI Agent Trust and Kasada IQ for Fraud, and offers a demo as the only route in.
- Pricing: Quote only. No price shown; the single call to action is Book a demo. No free trial mentioned. Free plan: none.
- Best for: Enterprises under scraping and account attacks
- Strengths: Bot Defense; Account Intelligence; AI Agent Trust.
Where it falls short
There is no pricing, no trial and no self-serve signup. The page does not show the legal entity or an address, so we could not state where the company is based.
Wrong for
Small teams wanting to test before talking to a salesperson, and anyone whose abuse is limited to form spam.
Visit Kasada →
#13 GeeTest
Bot management and CAPTCHA for web and app · Not stated · geetest.com
CAPTCHA v4 Fingerprinting Free trial
GeeTest pairs a CAPTCHA with the pieces fraud teams ask for: device fingerprinting, a business rules engine and protection pages for account takeover, credential stuffing, scraping and payment fraud.
- Pricing: Quote only. No prices shown; a Start Free Trial button appears without terms. Free plan: free trial.
- Best for: Teams wanting CAPTCHA plus fingerprinting
- Strengths: GeeTest CAPTCHA v4; Device fingerprinting; Business rules engine.
Where it falls short
No price is published and the trial terms are not stated on the page we read. The homepage carries no company address.
Wrong for
Buyers who need clear data-residency statements or a published price before a first call.
Visit GeeTest →
#14 Imperva Advanced Bot Protection
Enterprise bot detection across sites, apps and APIs · Not stated · imperva.com
Enterprise Bot mitigation Trial available
Imperva treats the CAPTCHA as a response, not the product: its bot protection detects automated traffic across websites, mobile apps and APIs, covers the OWASP Automated Threats list, and lists a CAPTCHA as one of its response options.
- Pricing: Quote only. No price published; a free trial link and a demo request form are offered. Free plan: free trial.
- Best for: Imperva customers consolidating security
- Strengths: Multi-layered detection; Granular controls and reporting; Adaptive protection.
Where it falls short
No price, and a sales path for the demo.
Wrong for
Small sites wanting a snippet and a monthly bill, and teams with no other Imperva products.
Visit Imperva Advanced Bot Protection →
#15 Akamai Bot Manager
Edge bot detection with a 0 to 100 bot score · Not stated · akamai.com
Enterprise Edge detection Bot score
Bot Manager works at the edge, scoring each request from 0 to 100 and separating malicious bots from good ones through a known bot directory, browser fingerprinting and AI-based detection. It includes real-time reporting and mobile app protection.
- Pricing: Quote only. Pricing not stated; a free demo and a live simulated attack demo are offered, no trial described. Free plan: none.
- Best for: Large sites already delivered through Akamai
- Strengths: AI-based bot detection; Browser fingerprinting; Known bot directory.
Where it falls short
Pricing is not published, no trial is described and no free plan exists. The vendor's figure of more than 40 billion bots a day is a marketing claim.
Wrong for
Sites that do not use Akamai, and buyers who need a price before a call.
Visit Akamai Bot Manager →
Questions and answers
What is the best CAPTCHA software in 2026?
Friendly Captcha ranks first of 15, best for privacy-minded sites with modest traffic. ALTCHA is second (developers who want free code or cheap hosting) and Private Captcha third (european agencies protecting client forms). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
Is reCAPTCHA still free?
Partly. Google's tier table lists Essentials as free up to 10,000 assessments per calendar month, counted across the whole organization, and it requires a valid billing instrument in Google Cloud.
Can a CAPTCHA work without cookies or tracking?
Yes. Private Captcha's homepage lists no cookies, mCaptcha says it does not track or profile users, and ALTCHA lists no tracking among its features. Friendly Captcha verifies in the background using proof-of-work and risk signals rather than image labeling.
What is proof-of-work CAPTCHA and does it stop determined bots?
Proof-of-work asks the visitor's browser to solve a small computational puzzle, so each request costs the sender computing time. Friendly Captcha, mCaptcha and Cap describe this approach.
Can I host a CAPTCHA myself?
Yes, several options exist. Cap runs as a single Docker container under Apache 2.0, mCaptcha is AGPL v3 self-hosted software, and ALTCHA's widget is MIT licensed with no usage limits stated on its FAQ.
How hard is it to switch away from reCAPTCHA?
Easier than most software changes. The widget on each page must be replaced, and the server-side verification call must point to the new vendor.
What does hCaptcha cost after the free plan?
Pro costs $99 a month billed yearly or $139 billed monthly, according to its pricing page, and includes 100K monthly evaluations, then $0.99 per extra 1K.
Are invisible CAPTCHAs accessible?
They remove the puzzle that blocks screen-reader and low-vision users, which is the main accessibility gain.
When is enterprise bot defense worth it over a CAPTCHA?
When the attacker adapts and the losses are measurable: account takeover, card testing, scraping of priced catalogs, fake-account farms.
Does a CAPTCHA reduce conversion?
It can, mainly when it shows puzzles to genuine visitors. Private Captcha claims 0.3 seconds to complete against 20 seconds for a traditional CAPTCHA, which is a vendor comparison, not a study.
How much should a small site spend on CAPTCHA?
Often nothing. Cloudflare Turnstile has a free plan, MTCaptcha is free to 10K verifications a month, Prosopo's Procaptcha to 10,000 requests, and Cap, mCaptcha and the ALTCHA widget are open source.
