A hosted Cap alternative with nothing to run
Updated
Cap and Bot403 both make the browser solve a proof of work. With Cap, you run the server. With Bot403, you do not.
Where Cap is better
Cap is free and open source under Apache 2.0, at any volume. It has checks against automated browsers. These checks are on by default for new site keys. Its siteverify API is compatible with reCAPTCHA. It has more than 8,000 stars on GitHub. If you can run a container, Cap costs nothing and you own all of it.
Where Bot403 is better
To self-host Cap Standalone, the Cap docs recommend Docker, with a Valkey database, on a server that the internet can reach. On your side, Bot403 needs only one script tag and one API call. Bot403 runs the server, stores used tokens, applies rate limits and shows failures by reason. The free plan covers 5,000 checks a month on 2 sites, and 50,000 checks cost €3 a month.
Side by side
The facts come from the public pages of Cap (https://trycap.dev/guide/standalone/, https://trycap.dev/, https://trycap.dev/guide/open-source-captcha, https://trycap.dev/guide/capjs-core.html, https://trycap.dev/guide/widget.html, https://github.com/tiagozip/cap), checked on 2026-10-23. "Not stated" means the page does not say. If something changed, email me. Then I will correct it.
| Capability | Bot403 | Cap |
|---|---|---|
| License | hosted service. ALTCHA protocol, MIT | Apache 2.0 |
| Price | free for 5,000 a month, then €3 a month | free at any volume, no paid tier |
| What you run | nothing | Standalone: a container (Docker recommended) and Valkey, reachable from the internet |
| Library in your own server | not needed | capjs-core. You add replay protection yourself |
| Browser script | 6 KB, invisible | about 20 kB gzipped. Programmatic mode shows no widget |
| Other requests from the browser | none | WASM files from jsDelivr by default. You can host them yourself |
| Cookies | none | none |
| reCAPTCHA-compatible siteverify | no | yes |
Switch in 10 minutes
Remove the Cap script and widget from the page. Add one script tag with your public key. On the server, replace the Cap verify call with a POST to /api/v1/verify. The verify page has the request for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby. The form fields stay as they are.