Why it exists

CAPTCHA is where "free" web services pay with their users' dignity: reCAPTCHA's puzzle walls double as free AI-training labeling and cross-site tracking, every extra third-party script is a GDPR problem, and none of it is accessible. ALTCHA inverts the model: instead of watching users, it gives every visitor the same silent cryptographic challenge — a small proof-of-work computed in the browser that bots pay CPU for and humans never notice. No cookies, no fingerprinting, no third-party data sharing means the form stays GDPR-compliant without a consent banner, and the widget is WCAG 2.2 AA conformant with full keyboard navigation and screen-reader support — accessibility features reCAPTCHA still can't match.

Main features

• Proof-of-work, frictionless by default — invisible cryptographic verification for every visitor; no puzzles, no sign-up, no API keys, no usage limits on the open-source widget.
• Adaptive escalation — Cloud and Sentinel add risk signals: low-risk traffic stays frictionless, an accessible interactive check (typed code, audio in 50+ languages) runs only when traffic looks automated.
• Radically compliant — no cookies, no tracking scripts, no personal data collected, no third-party sharing; EU-only endpoints on Cloud; ePrivacy/cookie-law friendly.
• Genuinely accessible — WCAG 2.2 AA conformance, keyboard-navigable, screen-reader labelled, no visual puzzles.
• Self-hosting without compromise — the full Sentinel platform runs on-premise, air-gapped if required; data sovereignty is a product tier, not a bribe.
• Drop-in everywhere — official libraries for C++, Dart, .NET, Elixir, Go, Java, JS/TS, PHP, Python and Ruby; React/Vue/Svelte/Angular/Solid/Lit widgets; WordPress and Django plugins; migration guides for reCAPTCHA, hCaptcha and Turnstile.
• 50+ languages with automatic language detection and a themeable, brandable UI.

Who it's for

• Public-sector sites, governments and regulated organizations that need bot protection their legal team can sign off on (300,000+ live sites use it).
• Any site tired of paying reCAPTCHA's double bill: cookie-banner overhead plus user frustration.
• EU businesses that want protection with EU data residency and no foreign cloud in the loop.
• Developers who want protection that doesn't fight them on accessibility.

How it compares

• Google reCAPTCHA — free but tracked, closed, puzzle-heavy; the comparison table on ALTCHA's site is just the two products' honest feature lists.
• Cloudflare Turnstile — privacy-friendlier than reCAPTCHA but still third-party (your forms trust Cloudflare); ALTCHA can run entirely on your own infrastructure.
• hCaptcha — puzzle-based and third-party; neither applies to ALTCHA's model.
• Friendly Captcha — the closest philosophy (proof-of-work, German); ALTCHA adds the self-hosted Sentinel platform, broader language coverage and an MIT-licensed core.
• Honeypot fields — zero-cost first defense; ALTCHA is what you layer on when honeypots stop stopping bots.

Notes

• The open-source widget is free forever with no sign-up — Cloud (from €47/month) and Sentinel (from €99/month) buy hosted analytics, adaptive threat intelligence and support, not the right to keep using the core.
• Server-side verification is still your job: the widget issues the challenge, your backend validates it — the libraries exist exactly for that.
• EU-registered trademark (No. 019015396); the company is wholly Czech-owned, which the EU data-residency story leans on.
• Migrations are documented as under-an-hour drop-in swaps — your form-submission flow stays the same, only the widget and its verification call change.

Useful links

• Official site: https://altcha.org/
• Source code: https://github.com/altcha-org/altcha
• How it works: https://altcha.org/docs/how-it-works/
• Cloud playground: https://playground.altcha.org/
• Legal info (ownership & licensing): https://altcha.org/legal/general/