Bot403 as a reCAPTCHA alternative
Updated
Both stop bots on web forms. The differences are in what the visitor sees, what runs on your page, what the free plan includes, and where the data is stored.
Where reCAPTCHA is better
reCAPTCHA scores each visitor with signals from Google's network, so it catches human-driven abuse that a proof of work cannot see. It is free up to 10,000 assessments a month, has SDKs for iOS and Android, and runs on Google's infrastructure in many regions. If you need risk scores, mobile SDKs or an uptime guarantee, reCAPTCHA is the stronger product. Bot403 asks the browser for a fifth of a second of work and asks the visitor for nothing, and it never loads a third-party script on your page.
Where Bot403 is better
Bot403 never shows a puzzle, sets no cookies and loads nothing from third parties on your page. The token format is open (Altcha, MIT), so your server can verify it with an open-source library or with the API. The dashboard shows failures by reason and the origins that send them. Everything runs on one server in the EU, and the free plan has 5,000 checks a month.
Side by side
The facts come from the public page of reCAPTCHA (https://cloud.google.com/recaptcha/docs/compare-tiers), checked on 2026-09-18. "Not stated" means the page does not say. If something changed, email me. Then I will correct it.
| Capability | Bot403 | reCAPTCHA |
|---|---|---|
| Method | proof of work | risk score, puzzles |
| Visible puzzle for visitors | never | sometimes |
| Third-party script on your page | no, only ours | yes, from Google |
| Cookies set by the widget | none | not stated |
| Accessibility | nothing to click or read | audio puzzle |
| Free tier a month | 5,000 verifications | 10,000 assessments |
| First paid tier | €3 a month for 50,000, VAT included | $8 up to 100,000, then $1 per 1,000 |
| Open-source core | Altcha, MIT | not stated |
| Hosted in the EU | yes | not stated |
Switch in 10 minutes
Remove the reCAPTCHA script and widget from the page. Add one script tag with your public key. On the server, replace the reCAPTCHA verify call with a POST to /api/v1/verify. The verify page has the request for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby. The form fields stay as they are.