7 Best reCAPTCHA Alternatives for Forms and APIs

reCAPTCHA alternatives at a glance

Why are people replacing Google reCAPTCHA?

Three things changed: the price, the legal picture, and the performance cost. None of them were true 5 years ago.

What happened to reCAPTCHA’s free tier?

Google cut it from 1,000,000 assessments a month to 10,000. That quota counts per Google Cloud organization, not per site. So every form on every domain you run draws from one shared pool.

Here’s the part that catches people out. If you pass 10,000 assessments with no billing account, requests return a Resource Exhausted (429) error. Checking stops until the next calendar month.

Your forms don’t start rejecting spam. They stop being checked at all, quietly.

With billing enabled, Google’s pricing runs:

• 0 to 10,000 assessments a month: free
• 10,001 to 100,000: $8 flat
• Over 100,000: $0.001 per assessment

That’s cheap. But it’s a Google Cloud billing account plus a quota to monitor. For something that used to be free and invisible.

Does reCAPTCHA slow your site down?

It adds third-party JavaScript to every page with a form. Perfmatters measured over 400KB of JavaScript. They also recorded a Core Web Vitals drop of 20 to 30 points.

Those are their numbers, not ours. Your results will vary depending on how many pages the widget loads. The general point still holds. A script on every form page has a cost that a server-side check doesn’t.

What should you look for in a reCAPTCHA alternative?

Judge every option on 6 things. A tool can win on privacy and still annoy your users:

• Friction. Does a real person ever have to do anything?
• What it actually blocks. Spam content, automated scripts, or credential stuffing? Those are different jobs.
• Privacy and data residency. Where does visitor data go, and does it set cookies?
• Accessibility. Image puzzles fail screen readers. Look for WCAG 2.2 AA.
• Free tier honesty. Is the limit published? Is it monthly or lifetime?
• Integration effort. A widget swap takes an afternoon. Self-hosting is ongoing work.

What are the best reCAPTCHA alternatives?

1. Honeypot field

Add a form field that humans can’t see, then reject any submission that fills it. Bots complete every field they find. A value in that field is a reliable bot signal.

It costs nothing and adds no JavaScript. It’s also the layer most people skip when recommending a paid product.

• Free tier: free forever, it’s your own code
• Blocks: naive form-filling bots, which covers most drive-by spam
• Best for: every form, underneath whatever else you use
• Honest limitation: it won’t stop a bot written against your specific form. It does nothing about spam typed by a human

Start here regardless of what else you choose. There’s working code for it further down.

2. ActiveLayer

Send the submission to an API and get a spam verdict back. There’s no widget on the page at all. ActiveLayer analyzes the content, sender, and reputation signals server-side.

Because it runs after the user submits the form, your visitors never see a challenge. No checkbox, no crosswalks. Accessibility problems disappear when there is no widget.

• Free tier: “1,000 checks in total. No credit card required.”
• Paid: Pro starts at $19/month for 25,000 checks. Agency at $49/month for 100,000. While Enterprise starts at $149
• Rate limit: 50 requests per minute per key
• Claims: 99.5%+ accuracy, per ActiveLayer
• Blocks: spam content in forms and comments
• Best for: contact forms, comments, and any form where friction costs you leads
• Honest limitation: it reads content, so it won’t stop credential stuffing or login brute-force attempts. Those need rate limiting or a CAPTCHA at the auth endpoint. The free tier is also a one-time 1,000 checks. A busy form will need a paid plan quickly

3. Cloudflare Turnstile

Turnstile swaps the reCAPTCHA widget for non-interactive challenges that usually show nothing. Cloudflare runs “proof-of-work (computational puzzles), proof-of-space, probing for web APIs, and various other challenges” in the background.

One thing I noticed while testing it that’s worth knowing. The recommended Managed widget “automatically decides whether to show a checkbox based on visitor risk level.” Some visitors will still need to click something.

• Free tier: free.
• Blocks: automated browsers and scripted submissions
• Best for: teams who want a widget swap with almost no code change
• Honest limitation: it’s still a widget with a script on the page. Risky visitors may see a checkbox

You don’t need to move your DNS to use it. Cloudflare states that Turnstile “can be embedded into any website without sending traffic through Cloudflare.”

4. hCaptcha

hCaptcha is built to be API-compatible with reCAPTCHA. It markets the migration as “Switch with two lines of code.” If reCAPTCHA is wired deep into a legacy codebase, this is the shortest path out.

• Free tier: Basic plan at $0. hCaptcha doesn’t publish a request limit for it
• Paid: Pro $139/month, or $99/month billed annually. Includes 100K monthly evals, then $0.99 per 1K
• Compliance: GDPR, CCPA, LGPD, PIPL, per hCaptcha
• Blocks: bots, with challenge difficulty scaled to risk
• Best for: migrating off reCAPTCHA with minimal code changes
• Honest limitation: the low-friction “99.9% Passive Mode” sits on the Pro plan. Free-plan users can get visual challenges

That last point matters more than it looks. The free tier is the one most small sites will use. It’s also the one that still shows puzzles.

5. ALTCHA

ALTCHA uses a proof-of-work challenge that the browser solves silently. You can run the whole thing yourself. No third-party service ever sees your visitors.

• Free tier: free and open source
• Blocks: scripted submissions, by making them computationally expensive
• Best for: teams whose privacy requirements rule out any external service
• Honest limitation: self-hosting is real work. You own the uptime, the updates, and the tuning

Proof-of-work carries a quiet cost too. It burns a little CPU on your visitor’s device. That’s felt most on older phones.

6. Friendly Captcha

Friendly Captcha runs proof-of-work from EU-hosted infrastructure and targets WCAG 2.2 Level AA. It’s aimed at teams whose blocker is compliance rather than cost.

• Free tier: Free supports up to 1,000 requests per month. Paid plans start at €9/month
• Blocks: automated submissions, without user-facing puzzles
• Best for: EU organizations with documented privacy and accessibility obligations
• Honest limitation: no public pricing. You’ll talk to sales before you know the cost

7. AWS WAF CAPTCHA

AWS WAF CAPTCHA puts the challenge at the edge, before traffic reaches your app. It only makes sense if you already run AWS WAF.

• Free tier: none. It’s priced per WAF request and per challenge attempt
• Blocks: bots at the network edge, across every route, not just forms
• Best for: teams already paying for AWS WAF
• Honest limitation: it shows a real interactive puzzle. That makes it the highest-friction option here. Standing up WAF to protect one contact form is heavy

How to add spam protection to a form without a CAPTCHA

The best approach is to implement it with 2 layers. A honeypot field catches lazy bots for free. A server-side API check handles whatever survives.

Here is an example implementation using Next.js.

Add a honeypot field

Add an input that real users never see, then reject submissions that fill it. Hide it with CSS, not the hidden attribute. Some bots skip hidden inputs.

// components/ContactForm.jsx
<form onSubmit={handleSubmit}>
  <label htmlFor="name">Name</label>
  <input id="name" name="name" required />

  <label htmlFor="email">Email</label>
  <input id="email" name="email" type="email" required />

  <label htmlFor="message">Message</label>
  <textarea id="message" name="message" required />

  {/* Honeypot. Off-screen for sighted users, skipped by screen readers,
      and unreachable by keyboard. Bots fill it anyway. */}
  <div style={{ position: 'absolute', left: '-9999px' }} aria-hidden="true">
    <label htmlFor="contact-ref">Website</label>
    <input id="contact-ref" name="contact_ref" tabIndex={-1} autoComplete="off" />
  </div>

  <button type="submit">Send message</button>
</form>

Two attributes do the real work. aria-hidden="true" stops screen readers from announcing the field. tabIndex={-1} stops keyboard users from tabbing into it. Skipping either one results in an accessibility bug, not a spam filter.

Name the field something a bot wants to fill. Avoid honeypot. Also avoid website and url, because browser autofill sometimes populates those. A neutral name like contact_ref sidesteps both problems.

How to check submissions server-side in Next.js

If you’re using ActiveLayer, you can directly call the API from Next.js or any custom app you’re using.

Ideally, after the honeypot check. Both layers run on the server, so neither is visible to the client.

// app/api/contact/route.ts
import { NextRequest, NextResponse } from 'next/server'
import { sendNotification } from '@/lib/notify'

const CHECK_URL = 'https://api.activelayer.com/api/v1/check'

export async function POST(req: NextRequest) {
  const { name, email, message, contact_ref } = await req.json()

  // Layer 1: the honeypot. A value here means a bot filled it in.
  // Return 200, not an error. Don't tell the bot it was caught.
  if (contact_ref) {
    return NextResponse.json({ ok: true })
  }

  if (!email || !message) {
    return NextResponse.json({ error: 'Missing required fields' }, { status: 400 })
  }

  // Layer 2: ask ActiveLayer whether the content looks like spam.
  let verdict
  try {
    const res = await fetch(CHECK_URL, {
      method: 'POST',
      headers: {
        Authorization: `Bearer ${process.env.ACTIVELAYER_API_KEY}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        message,
        email,
        name,
        ip: req.headers.get('x-forwarded-for') ?? undefined,
        user_agent: req.headers.get('user-agent') ?? undefined,
      }),
    })
    if (!res.ok) throw new Error(`Check failed: ${res.status}`)
    verdict = await res.json()
  } catch (err) {
    // Fail open. A rate limit or exhausted quota shouldn't cost you a real lead.
    console.error('Spam check unavailable, delivering anyway', err)
    await sendNotification({ name, email, message })
    return NextResponse.json({ ok: true })
  }

  if (verdict.is_spam) {
    return NextResponse.json({ ok: true })
  }

  await sendNotification({ name, email, message })
  return NextResponse.json({ ok: true })
}

Sending the request directly shows you the shape of the exchange:

curl -X POST https://api.activelayer.com/api/v1/check \
  -H "Authorization: Bearer $ACTIVELAYER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Cheap designer bags, click my link!",
    "email": "[email protected]",
    "name": "Bag Deals",
    "ip": "203.0.113.42"
  }'

The response carries the verdict and the score behind it:

{
  "detection_id": "det_9f2c41a8",
  "is_spam": true,
  "total_score": 0.94,
  "threshold": 0.8,
  "execution_time": 82.4,
  "timestamp": "2026-08-26T14:12:09Z"
}

Branch on is_spam and leave the threshold alone. The API returns the threshold it applied and the total_score it measured. You don’t need to invent a cutoff. Log detection_id and you can look up any single decision later.

How to send the notification email

After implementing the checks, you’ll traditionally want to send a notification email to yourself and the user.

Here’s how to add the email notification layer using the Nodemailer transport. A form that filters spam perfectly is still broken if the email never arrives.

// lib/notify.ts
import nodemailer from 'nodemailer'

const transporter = nodemailer.createTransport({
  host: 'smtp.sendlayer.net',
  port: 587,          // 587 for TLS, 465 for SSL
  secure: false,      // STARTTLS upgrades the connection on 587
  auth: {
    user: process.env.SENDLAYER_USER,
    pass: process.env.SENDLAYER_PASS,
  },
})

export async function sendNotification({ name, email, message }) {
  await transporter.sendMail({
    from: '[email protected]',   // must be a domain you've authenticated
    to: '[email protected]',
    replyTo: email,                 // replies go to the person who wrote in
    subject: `New contact form message from ${name}`,
    text: message,
  })
}

Set replyTo to the submitter’s address. Set from to a domain you’ve authenticated. Skip that second step, and your own notifications land in spam. For the full walkthrough, including HTML emails and attachments, see our guide on sending emails in Next.js with Nodemailer.

How to migrate off reCAPTCHA without breaking your forms

Run both systems side by side before you remove anything. A migration that drops real submissions costs more than the spam ever did.

1. Count your current volume. Check assessments in the Google Cloud console. Under 10,000 a month means you’re not being forced to move, so you can take your time.
2. List every form. Search your codebase for the reCAPTCHA site key. Forms in email footers and legacy landing pages get missed constantly.
3. Add the new layer, keep the old one. Run reCAPTCHA and the replacement together. Log both verdicts without acting on the new one.
4. Compare for a week. You’re looking for real submissions the new layer would have blocked. That number needs to be zero before you continue.
5. Switch the enforcement over. Act on the new verdict. Leave reCAPTCHA loaded but non-blocking for a few days.
6. Remove reCAPTCHA and its script. Delete the keys, then confirm no page still requests google.com/recaptcha.

Step 4 is the one people skip, and it’s the one that protects your leads. False positives are invisible until a customer tells you they couldn’t reach you.

When should you still use reCAPTCHA?

Sometimes reCAPTCHA is the correct answer. Keep it when:

• You’re under 10,000 assessments a month. The free tier covers you, and it already works.
• You’re already in Google Cloud. The billing account and quota monitoring exist.
• You need Google’s risk scores. reCAPTCHA v3 returns a score you can feed into your own logic, backed by a very large signal set.
• You’re defending logins, not content forms. Spam filtering reads content. It can’t tell a valid password attempt from the 400th one.

That last case is the important one. A content spam API and a CAPTCHA solve different problems. Is your issue credential stuffing, card testing, or scraping? Then you want rate limiting, a WAF, or a CAPTCHA at the auth endpoint. A spam filter won’t help.

Frequently Asked Questions

These are answers to some of the top questions users ask about choosing a reCAPTCHA alternative.

David Ozokoye

David is a technical writer at SendLayer. He tests and documents new features and updates to SendLayer's email services. Away from the computer, he enjoys playing video games and roller skating.

See Full Bio