OSI-licensed only · self-hostable
reCAPTCHA is Google's bot-detection service for web forms. It is proprietary, runs on Google's servers and sends visitor data to Google, which is the main reason sites look for replacements. Open-source options generally use proof-of-work or spam rules you control instead of behavioural tracking.
Every tool below is under an OSI-approved licence (MIT, Apache-2.0 or AGPL-3.0), checked against its repository. Anubis is a little different: it guards a whole site against scraper bots rather than checking a single form.
Licences checked against each repository on November 7, 2026.
| Tool | Best for | Licence | Runs as |
|---|---|---|---|
| ALTCHA | Privacy-first proof-of-work widget | MIT | Server |
| mCaptcha | Self-hosted proof-of-work CAPTCHA with an admin UI | AGPL-3.0 | Server |
| Cap | Lightweight self-hosted CAPTCHA | Apache-2.0 | Docker |
| mosparo | Form spam protection with rules you control | MIT | Server |
| Prosopo Procaptcha | Drop-in replacement for reCAPTCHA-style integration | Apache-2.0 | Server |
| Anubis | Shielding a site from AI scrapers | MIT | Server |
Best for: Privacy-first proof-of-work widget
A self-hosted, privacy-first security tool that uses proof-of-work to stop spam and abuse. A small widget on the form solves a challenge in the browser and your server verifies it.
Best for: Self-hosted proof-of-work CAPTCHA with an admin UI
A proof-of-work based, privacy-respecting CAPTCHA system. Runs as a server you host, with a dashboard to manage sites and difficulty.
Best for: Lightweight self-hosted CAPTCHA
A self-hosted CAPTCHA alternative that replaces puzzles with background proof-of-work and instrumentation challenges, built to protect user privacy.
Best for: Form spam protection with rules you control
The modern solution to protect your online forms from spam. Runs as a self-hosted service that checks submissions against configurable rules.
Best for: Drop-in replacement for reCAPTCHA-style integration
Described in its README as a drop-in replacement for reCAPTCHA, hCaptcha and Cloudflare Turnstile that is built to keep user data private.
Best for: Shielding a site from AI scrapers
A lightweight tool that screens incoming web traffic with challenges to shield servers from AI scraper bots. Sits in front of your site as a reverse proxy layer.
One email a week with the open-source projects, launches and releases added to TechLogHub. Unsubscribe in one click.
One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.
| If you need… | Start with |
|---|---|
| A simple widget on a contact or sign-up form | ALTCHA or Cap |
| A self-hosted CAPTCHA service with a dashboard | mCaptcha |
| Spam filtering rules for forms | mosparo |
| An integration pattern close to reCAPTCHA | Prosopo Procaptcha |
| Whole-site protection from scraper bots | Anubis |
Quick answers to common questions
Yes. ALTCHA (MIT), mCaptcha (AGPL-3.0), Cap (Apache-2.0), mosparo (MIT) and Prosopo (Apache-2.0) can all be self-hosted and avoid sending visitor data to Google.
The visitor's browser solves a small computational challenge in the background. This makes mass automated submissions costly without asking people to click images, though it does not prove the visitor is human.
They work differently: most rely on proof-of-work or rule-based checks rather than Google's behavioural scoring. Test against your own traffic before removing reCAPTCHA.
Anubis is built to shield servers from AI scraper bots by challenging incoming traffic. The others focus on forms.
No. All of them need a verification component you host or operate, so budget for a small service alongside your site.
List it on TechLogHub and we'll review it for this page.
