Alternatives / Cloudflare Turnstile
Looking for an open source Cloudflare Turnstile alternative? We compared 6 open source CAPTCHA tools by license, proof-of-work design, privacy, and self-hosting. Most use proof-of-work instead of image puzzles, so they work without tracking users, but several have license limits or small communities.
Written by Maxime DERAME
Last updated:
| Alternative | Best for | License |
|---|---|---|
| Cap | Lightweight proof-of-work CAPTCHA | AGPL-3.0 (+ MIT crates) |
| ALTCHA | Privacy-friendly widget with a free self-hosted tier | MIT core + paid Pro |
| mCaptcha | Rate-limiting proof-of-work (stalled) | AGPL-3.0 core, permissive client libraries |
| Procaptcha | Blockchain-based CAPTCHA | Apache-2.0 |
| Private Captcha | Invisible, cookie-free CAPTCHA | PolyForm Noncommercial (community edition) |
| Friendly Captcha | Invisible CAPTCHA with a closed backend | Closed backend; Lite server non-commercial source available |
We looked for open-source tools that protect forms from bots like Turnstile does, without sending users to a third party. We verified each project's license, recent activity, stars, and self-hosting in its repository, and flag projects with restrictive licenses or closed backends. See our methodology for the full criteria.
Cap is the most popular, with over 23,000 stars: a lightweight proof-of-work CAPTCHA with no tracking that runs standalone with Docker. ALTCHA is a privacy-friendly proof-of-work widget with a free open-source self-hosted tier, and mCaptcha is a proof-of-work CAPTCHA with rate limiting that does not rely on IP addresses.
Private Captcha uses the PolyForm Noncommercial licence, which does not allow commercial self-hosting, so it is not open source in the usual sense. Friendly Captcha's backend is closed source and its public lite self-hosted server is source available for non-commercial use, so it is only partly open. Procaptcha is a blockchain-based CAPTCHA with few details published.
mCaptcha's last commit was in October 2025, so it looks stalled. Friendly Captcha's public lite server last changed in February 2024. Check the project before depending on either for security.
ALTCHA's core is MIT. mCaptcha is AGPL-3.0 with libre client libraries. Procaptcha is Apache-2.0. Cap is AGPL-3.0 with MIT crates. Private Captcha is PolyForm Noncommercial.
Cap, ALTCHA, Procaptcha, and Private Captcha had commits within days of this update.
Turnstile is a free service, but it runs on Cloudflare's network, so every challenge goes through Cloudflare and you depend on its availability and policies. Open-source CAPTCHAs can be self-hosted so challenges never leave your servers, but you carry the operation and updates.
Cap is a cross-platform recorder for asynchronous work with instant, studio, and screenshot modes. Studio mode records up to 4K/60fps with a built-in editor, auto-zoom, blur, scene switching, backgrounds, color grades, and captions. Instant mode gives shareable links with transcripts and chapters. It can be self-hosted with S3-compatible storage and offers a CLI and MCP server.
Pricing: Free tier and open-source self-hosting; Cap Pro and cloud plans are paid.
ALTCHA is a proof-of-work CAPTCHA alternative that also offers spam filtering, analytics, and form tools. The open-source widget is MIT-licensed with a free tier, while advanced features require the Pro plan starting at €9 a month.
Pricing: Free open-source tier; Pro starts at €9 a month.
mCaptcha is a proof-of-work CAPTCHA that runs in the background and is presented as a drop-in reCAPTCHA replacement, self-hosted. The core is AGPL-3.0, with client libraries under more permissive licenses. Its last commit was in October 2025, so development has slowed.
Pricing: Free and open source.
Procaptcha is a CAPTCHA and bot-defense system from Prosopo, described as blockchain-based, with an Apache-2.0 repository. Its security and bot-resistance claims are marketing language, and the project gives few details on self-hosting.
Pricing: Free tiers and paid plans; check the website.
Private Captcha is a privacy-focused CAPTCHA that works without puzzles, tracking, or cookies, hosted in the EU. The community edition is distributed under the PolyForm Noncommercial License, so self-hosting is allowed only for non-commercial use, and commercial licenses are available. The paid service starts at €9 a month for 10,000 requests.
Pricing: Paid service from €9 a month; commercial self-hosting needs a commercial license.
Friendly Captcha is a proof-of-work CAPTCHA that runs invisibly and emphasizes privacy and accessibility. Its backend is closed source, and a Lite server for self-hosting is available under a non-commercial source-available license (Apache 2.0 with a Commons Attribution Clause), last updated in February 2024. Pricing ranges from free non-commercial use to enterprise plans.
Pricing: Free for non-commercial use; paid plans for businesses.
| Alternative | Type | License | Self-hosted | Best for |
|---|---|---|---|---|
| Cap | Proof-of-work CAPTCHA | AGPL-3.0 (+ MIT crates) | Yes | Replacing Turnstile |
| ALTCHA | Proof-of-work CAPTCHA | MIT (core) | Yes | GDPR-minded sites |
| mCaptcha | Proof-of-work CAPTCHA | AGPL-3.0 | Yes | Check maintenance first |
| Procaptcha | Decentralized CAPTCHA | Apache-2.0 | Yes | Web3 projects |
| Private Captcha | Proof-of-work CAPTCHA | PolyForm Noncommercial | Non-commercial only | Non-commercial sites |
| Friendly Captcha | Proof-of-work CAPTCHA | Closed backend; lite server public | Partly | Teams buying the hosted service |
Want a lightweight, self-hosted replacement
Cap is a small proof-of-work CAPTCHA with no tracking and a standalone Docker mode.
Want a free open-source tier with a widget
ALTCHA's core is MIT and runs without cookies, with a paid Pro plan for more.
Want rate limiting without IP tracking
mCaptcha rate-limits without relying on IP addresses, but its activity has stalled.