Looking for an hCaptcha alternative? Here is what changes

hCaptcha is a solid way to keep bots out without Google. But if you are reading this, something about it is not working for you, and it is usually one of three things.

Why people leave hCaptcha

• Puzzles on the free tier. hCaptcha says its free tier "provides a classic CAPTCHA experience in which most users will generally see a challenge" (source). Less friction is what Pro sells, at $99 a month billed annually for 100,000 evaluations.
• Cookies and a US processor. Its privacy policy lists cookies such as hmt_id (30 days), which hCaptcha considers consent-exempt, and says personal data is transferred to and stored in the United States. Whether that needs a consent banner depends on your implementation, and the decision is yours as the operator.
• The business model. The same policy says answers to its challenges are collected as labelled data for machine-learning use and may be disclosed to customers who want to acquire it. Your visitors are doing labelling work.

Bollwark vs hCaptcha

	hCaptcha	Bollwark
What the visitor sees	Free tier: most get a challenge	No image puzzle; low-risk visitors never click, higher-risk ones get a checkbox
How bots are slowed	Challenge plus risk analysis	Proof-of-work (Argon2id) plus two-pass risk scoring
Cookies	hmt_id and others	None
Where data is processed	United States	Germany (hosted), or your own server
Visitor answers reused for ML	Yes, as labelled data	No; nothing to answer
Free tier	Basic	1,000 verifies a month, one site
Paid	Pro from $99 a month (annual)	Priced from €9, not on sale yet
Self-host	No	Yes, MIT-licensed binary

Bollwark is young (version 0.1) and does not have hCaptcha's years of production traffic behind it. If you want to see how it does on your traffic before relying on it, start in monitor mode: it logs what its risk scoring would block without blocking on it. Validation checks, such as an invalid proof or the origin allowlist, stay active.

Migration: swap the widget and the verify call

Front end. Replace the hCaptcha container and script:

<!-- before -->
<div class="h-captcha" data-sitekey="your_site_key"></div>
<script src="https://js.hcaptcha.com/1/api.js" async defer></script>

<!-- after -->
<div id="captcha" data-sitekey="<SITE_KEY>"></div>
<script src="https://api.bollwark.eu/v1/widget.js"></script>

The token arrives in your form as captcha-token instead of h-captcha-response.

Back end. hCaptcha's siteverify takes a form-encoded secret and response. Bollwark takes the token as JSON, with the site secret as a bearer token:

const resp = await fetch("https://api.bollwark.eu/v1/verify", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.BOLLWARK_SECRET_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ token: req.body["captcha-token"] }),
});
const result = resp.ok ? await resp.json() : { success: false };
if (!result.success) return res.status(400).send("CAPTCHA failed");

Like hCaptcha's remoteip, you can forward the visitor's IP as remote_ip; it helps catch tokens solved on one machine and used on another. The full reference is in the verify guide.

Self-hosting instead? Run the binary and swap api.bollwark.eu for your own host; see self-host it.

Other alternatives worth a look

• Cloudflare Turnstile: free, with unlimited challenges, and usually invisible. Cloudflare collects the IP, TLS fingerprint and User-Agent. Compared in detail in Turnstile vs reCAPTCHA vs hCaptcha.
• ALTCHA: an MIT-licensed proof-of-work widget that you can self-host, with hosted tiers from €47 a month.
• Friendly Captcha: a German proof-of-work service that advertises zero cookies, from €9 a month.

FAQ

Is Bollwark free?

There is a free hosted tier of 1,000 verifies a month on one site, and self-hosting is free with no limits. See Bollwark pricing.

Do my visitors have to click anything?

Low-risk visitors do not; the puzzle solves in the background, and in invisible mode the widget does not render at all for them. Visitors the scorer considers riskier see an "I'm not a robot" checkbox and a harder puzzle. Nobody is asked to pick images.

Is it accessible?

Yes. The widget works entirely by keyboard, announces its state to screen readers, and keyboard users are not penalised by the behaviour scoring.