hCaptcha's free tier shows most visitors a challenge. Bollwark replaces it with an invisible proof-of-work check, no cookies, and the option to self-host. A side-by-side comparison and a migration guide.
reCAPTCHA sets a cookie and loads its code from Google before it can protect anything, so many EU sites gate it behind consent. What that breaks on your forms, and what to use instead.
A proof-of-work CAPTCHA makes the browser solve a puzzle instead of the human. How it works, why SHA-256 puzzles favour GPUs, why memory-hard Argon2id narrows the gap, and what proof-of-work cannot do alone.
Bollwark is an MIT-licensed, self-hostable proof-of-work CAPTCHA written in Rust. One binary, no cookies, no third-party calls, nothing stored on the visitor's device.
Turnstile, reCAPTCHA and hCaptcha compared on privacy, cookies, consent banners, friction, pricing and self-hosting, plus the self-hosted proof-of-work option none of the three offer.
Our registration form was gated by the least accessible challenge there is, while we sold the opposite. Here is what replaced it.
Bollwark