FCaptcha vs hCaptcha

FCaptcha vs hCaptcha: an open-source CAPTCHA you host yourself, with no image puzzles and no third party, against hCaptcha's hosted service.

hCaptcha became popular as a privacy-minded alternative to reCAPTCHA, and it works much the same way: a hosted checkbox that sometimes asks visitors to pick images. FCaptcha takes the privacy argument one step further. There’s no third party at all: it’s open-source software (MIT) that runs on your own server, and it never shows a puzzle.

At a glance

Where they differ

A processor, or none

hCaptcha is a privacy-focused processor, but it’s still a processor: visitor data leaves your site to be scored. FCaptcha has none. It sets no cookies, writes nothing to disk, and its COMPLIANCE.md lists every retention window.

Puzzles

An image challenge is the part of a CAPTCHA that people with low vision or motor impairments fail, and that vision models now pass. FCaptcha has no challenge to fail. It scores how the browser and the input behave, checks its widget against WCAG 2.2 AA in CI, and enforces a false-positive budget for screen-reader, keyboard-only and tremor users.

Running it

hCaptcha is a hosted service. FCaptcha is one you run: a single container with no database, but still something you operate.

Migrating from hCaptcha

Point your backend’s verify call at your FCaptcha server:

- https://api.hcaptcha.com/siteverify
+ https://your-fcaptcha-server.com/siteverify

The request (secret, response, remoteip) and the success/error-codes response match.

On the frontend, swap the hCaptcha script and h-captcha element for FCaptcha’s widget:

<form method="post" action="/signup">
  <div data-fcaptcha="your-site-key" data-endpoint="https://your-fcaptcha-server.com"></div>
  <button>Sign up</button>
</form>
<script src="https://your-fcaptcha-server.com/fcaptcha.js"></script>

Your backend reads the token from fcaptcha_token instead of h-captcha-response. From v1.45.0 the widget adds that field itself; on earlier versions, set it from the widget’s callback.

Try it

• Live demo
• Source and documentation on GitHub