CAPTCHA alternatives in 2026

6 min readSources checked 2 Oct 2026Sources at the end

Image puzzles cost people time. Here are seven CAPTCHA alternatives, from bot protection to human verification, and what each proves.

Shop owner packing an order and smiling at his phoneAI-generated image
No puzzle to solve7 ways to check without one
Short answer

To keep bots off a form, a free invisible check is usually enough. To know a real person acted, you need identity.

Start with the question you need answered. Then pick the lightest tool that answers it.

Four questions, seven approaches

Is this a bot?
reCAPTCHA v3hCaptchaTurnstileProof-of-work
Quiet, cheap, anonymous
Who is this person?
PersonaOnfido (Entrust)
An ID plus a selfie
Is this a unique person?
World ID
One person, one proof
Did a verified person do this?
5arz
A signed seal on each action
Bot checks judge the browser. The other three judge the person.

The 7 approaches compared

What do you need?
Showing all 7 approaches.

Invisible risk scoring

reCAPTCHA v3User does: nothing
Proves
A risk score from 0.0 (likely bot) to 1.0 (likely good) 1, 2
Free up to 10,000 assessments a month
Doesn’t prove
Who the visitor is. A score is a likelihood, not proof
Best forScoring traffic, then sending risky logins to 2FA

Privacy-first challenges

hCaptchaUser does: a puzzle; passive on Pro
Proves
The visitor passed a bot check, on a Zero-PII design 3, 4
Free Basic plan; Pro adds a 99.9% passive mode
Doesn’t prove
Who solved it. It’s a bot signal, not identity
Best forReplacing reCAPTCHA with stricter privacy terms

Managed non-interactive checks

Cloudflare TurnstileUser does: usually nothing
Proves
The browser passed quiet checks; the token lasts 5 minutes 5, 6
Free: unlimited challenges, up to 20 widgets
Doesn’t prove
Who the visitor is, or what they did later
Best forFree bot protection on any form

Proof-of-work and rate limits

Friendly Captcha · rate-limit rulesUser does: nothing
Proves
The device solved a puzzle; traffic stays under your limit 7, 8
Friendly Captcha says it sets zero cookies
Doesn’t prove
That a human is there, only that work was done
Best forRaising bot cost without cookies or tracking

ID + liveness verification

Persona · Onfido (Entrust)User does: an ID photo and a selfie
Proves
A real ID document matched to a live face 9, 10
Persona covers IDs from 200+ countries and territories
Doesn’t prove
What the person does after onboarding
Best forKYC and regulated onboarding

Uniqueness proofs

World IDUser does: an Orb visit, for the top level
Proves
A unique person, shown by a zero-knowledge proof (World ID) 11
Orb data is held only on your device, per World
Doesn’t prove
Who you are. Apps see only a valid World ID
Best forOne person, one entry: votes, airdrops, rewards

Signed proof-of-person credentials

5arzUser does: verify once on a phone
Proves
An ID-verified person did a specific thing, at a specific time 12
A seal signed with ES256 that anyone can check free, offline
Doesn’t prove
That each person holds only one account. Read sybil_checked first
Best forApprovals, labeled data, AI agents acting for people

Superscript numbers point to the Sources list below.

Deep dive: 5arz vs Cloudflare Turnstile →

Which one you need

If you need to stop bots, freeTurnstile, reCAPTCHA v3 or hCaptcha
If you want no cookies or trackingProof-of-work plus rate limits
If you must know who a customer isAn ID check: Persona or Onfido
If it’s one person, one entryWorld ID
If you need proof a verified person acted5arz, with a seal anyone can check
Most sites stack twoA bot check on every form, identity where it matters

Questions

What is the best CAPTCHA alternative?

It depends on the question. To stop bots on a form, a free invisible check is a strong default. To know a real person acted, you need identity.

Is an invisible CAPTCHA enough?

For most forms it’s a good first layer. Google suggests stepping up to 2FA or email checks when a login scores low.

What is an invisible CAPTCHA?

A check that runs in the background, with no puzzle. reCAPTCHA v3, Turnstile’s invisible mode, hCaptcha’s paid passive modes and Friendly Captcha work this way.

Do any prove one account per person?

World ID is built for that. Persona can match a new ID against existing accounts. A 5arz seal doesn’t by itself, so read sybil_checked first.

Is 5arz a CAPTCHA?

No. It doesn’t judge browsers, so keep bot protection on your forms. 5arz signs proof that an ID-verified person did something, and anyone can check it free.

Sources

Read on 2 Oct 2026. Features and prices can change — check the source.

  1. 1reCAPTCHA v3developers.google.com
  2. 2reCAPTCHA tiers and pricingdocs.cloud.google.com
  3. 3hCaptchahcaptcha.com
  4. 4hCaptcha pricinghcaptcha.com
  5. 5Cloudflare Turnstiledevelopers.cloudflare.com
  6. 6Turnstile plansdevelopers.cloudflare.com
  7. 7Friendly Captchafriendlycaptcha.com
  8. 8Rate limiting rulesdevelopers.cloudflare.com
  9. 9Persona government IDwithpersona.com
  10. 10Entrust identity verification (Onfido)entrust.com
  11. 11World IDworld.org
  12. 125arz public key5arz-oracle-2 · ES256

Product names are trademarks of their respective owners. 5arz is independent and is not affiliated with, sponsored by, or endorsed by any of them. This page is informational and not legal advice.

Keep reading

All guides →