An hCaptcha alternative with no image puzzles
Updated
Both stop bots on web forms. The differences are in what the visitor sees, what runs on your page, what the free plan includes, and where the data is stored.
Where hCaptcha is better
hCaptcha has native SDKs for iOS, Android and React Native. Its API methods are compatible with reCAPTCHA, so a migration from reCAPTCHA is a small change. The Enterprise plan adds risk scores and bot detection. These features see more than a proof of work can see. On Pro, the goal of its passive mode is to show a challenge to fewer than 0.1% of real people. If you need mobile SDKs or risk scores, hCaptcha does more.
Where Bot403 is better
Bot403 is invisible on every plan, also on the free plan. Visitors never get an image task: the browser does a short proof of work, and the visitor does nothing. The script sets no cookie. The data stays on one server in Germany, and Bot403 never stores visitor IP addresses. 50,000 checks cost €3 a month.
Side by side
The facts come from the public pages of hCaptcha (https://www.hcaptcha.com/pricing, https://docs.hcaptcha.com/pro, https://docs.hcaptcha.com/invisible, https://www.hcaptcha.com/accessibility, https://www.hcaptcha.com/privacy), checked on 2026-10-23. "Not stated" means the page does not say. If something changed, email me. Then I will correct it.
| Capability | Bot403 | hCaptcha |
|---|---|---|
| Method | proof of work | challenges, and risk scores on Enterprise |
| What visitors see on the free plan | nothing | a challenge for most visitors |
| Invisible mode | always | no checkbox. A challenge still shows when a visitor meets the criteria |
| Free plan | 5,000 checks, 2 sites, no card | Basic, $0, limits not stated |
| First paid plan | €3 a month for 50,000 on 10 sites, VAT included | Pro: $99 a month billed yearly or $139 monthly, 100,000 evaluations, then $0.99 per 1,000 |
| Cookies set by the widget | none | not stated. People who sign up for accessibility get a cookie |
| Accessibility | nothing to click or read | a text challenge or an accessibility sign-up |
| Mobile SDKs | none | iOS, Android, React Native |
| Where data is processed | Germany | the United States, as its privacy policy says |
Switch in 10 minutes
Remove the hCaptcha script and widget from the page. Add one script tag with your public key. On the server, replace the hCaptcha verify call with a POST to /api/v1/verify. The verify page has the request for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby. The form fields stay as they are.