A reCAPTCHA alternative that respects your visitors
Updated:
Quick answer
A good reCAPTCHA alternative verifies visitors without cookies or image puzzles, processes data in the EU, publishes its data processing agreement and accepts requests in the same format, so you can switch by changing a script URL and a pair of keys. Burgcaptcha does this with a proof-of-work task in the browser and request risk signals.
Why teams replace reCAPTCHA
- Visitors can be asked to solve image challenges, which slows sign-ups and is hard for people who use assistive technology.
- reCAPTCHA is operated by Google, a US company. Your data protection officer has to assess the processing, the transfer of data outside the EU and any storage on the visitor’s device.
- Usage beyond the free allowance is billed through Google Cloud, and invisible scoring (v3) needs someone to choose and tune score thresholds.
What to check in any alternative
| Criterion | Why it matters | How to verify |
|---|---|---|
| Cookies and device storage | Storing or reading data on the visitor’s device can require consent (in Germany § 25 TDDDG). | Open the browser developer tools and check Cookies, Local Storage and network requests on a page that uses the widget. |
| Data location | EU-only processing avoids transfers outside the EU. | Ask for the hosting country and the list of sub-processors. |
| Data processing agreement | You need one with every processor (Art. 28 GDPR). | Check that it is public or sent on request before you sign up. |
| Challenge type | Puzzles add friction and can exclude users. | Try the live demo with keyboard only and with a screen reader. |
| Accessibility | WCAG 2.2 AA is the usual target; the European Accessibility Act raises the stakes. | Ask for the audit report, not only a badge. |
| Migration effort | Less code to change means less risk. | Check whether the API answers in the reCAPTCHA response format. |
How to switch from reCAPTCHA to Burgcaptcha
Plugins for WordPress, Shopware, TYPO3, Magento and Keycloak and libraries for React, Vue and Angular are planned so that most sites need no code at all.
- Request a demo and receive your site key and secret.
- Replace the Google script URL in your page with the Burgcaptcha widget script.
- Replace the widget element and set data-sitekey to your new site key.
- On your server, change the verification URL and secret. The response uses the same fields, such as success.
- Test sign-up and login, then remove the Google script and the related entries from your Content Security Policy.
Burgcaptcha and reCAPTCHA side by side
| Burgcaptcha | Google reCAPTCHA | |
|---|---|---|
| Method | Proof-of-work in the browser plus risk signals | Image challenges (v2) or invisible risk score (v3) |
| Cookies | None set by the widget | See Google’s documentation |
| Hosting | EU on every plan | Operated by Google |
| Free option | Yes, 1,000 requests per month, commercial sites included | Free allowance, then billed through Google Cloud |
| Migration | Same response format, change URL and keys | — |
Frequently asked questions
What is the best reCAPTCHA alternative?
The best alternative depends on your constraints, but a privacy-first choice verifies visitors without cookies or puzzles, hosts data in the EU, publishes its data processing agreement and is API-compatible with reCAPTCHA. Burgcaptcha, Friendly Captcha, CaptchaFox, captcha.eu and ALTCHA all fit parts of that description.
Is there a reCAPTCHA alternative without cookies?
Yes. Proof-of-work CAPTCHAs such as Burgcaptcha run a small calculation in the browser instead of storing an identifier, so the widget needs no cookies. Check each provider’s documentation and your browser’s developer tools to confirm.
Do I have to rewrite my forms to switch?
Usually not. If the alternative answers in the reCAPTCHA response format, you replace the script URL, site key, verification URL and secret. Test sign-up and login before removing the Google script.
Is it free?
Burgcaptcha has a free plan for up to 1,000 requests a month, commercial sites included.