FCaptcha vs Google reCAPTCHA

FCaptcha vs Google reCAPTCHA: an open-source CAPTCHA you host yourself, with no image puzzles and no visitor data sent to Google.

reCAPTCHA is the CAPTCHA most people know: the “I’m not a robot” checkbox (v2), the image grids that sometimes follow it, and the invisible score (v3). It runs on Google’s infrastructure. FCaptcha does the same job, a checkbox or an invisible score, as open-source software (MIT) on your own server.

At a glance

Where they differ

Privacy and consent

reCAPTCHA sends visitor data to Google. In the EU that usually raises questions about consent banners, data transfers and your processor list. FCaptcha has no third party: it sets no cookies and writes nothing to disk, and its COMPLIANCE.md lists every retention window.

No puzzles

When reCAPTCHA v2 isn’t sure, it shows an image grid. Vision models now solve those, while people with low vision or motor impairments struggle with them. FCaptcha never shows a puzzle. It scores how the browser and the input behave, and checks its widget against WCAG 2.2 AA in CI.

Seeing the reasons

reCAPTCHA v3 gives you a number. FCaptcha gives you a number plus the detections behind it, so you can see why a real customer was blocked and tune it.

Running it

reCAPTCHA is zero operations: Google runs it. FCaptcha is a service you run. It’s a single container with no database, but it’s still something you operate.

Migrating from reCAPTCHA

Point your backend’s verify call at your FCaptcha server:

- https://www.google.com/recaptcha/api/siteverify
+ https://your-fcaptcha-server.com/recaptcha/api/siteverify

The request (secret, response, remoteip) and the response (success, challenge_ts, hostname, error-codes) match.

If you use reCAPTCHA v3 scores, flip the comparison. reCAPTCHA’s score runs from 0.0 (likely a bot) to 1.0 (likely human). FCaptcha’s runs the other way: 0 is human, and 0.5 is the default bot threshold. A token is only issued below that threshold, so checking success is enough. If you also threshold the score, change score >= 0.5 to score < 0.5.

On the frontend, swap the reCAPTCHA script and g-recaptcha element for FCaptcha’s widget:

<form method="post" action="/signup">
  <div data-fcaptcha="your-site-key" data-endpoint="https://your-fcaptcha-server.com"></div>
  <button>Sign up</button>
</form>
<script src="https://your-fcaptcha-server.com/fcaptcha.js"></script>

Your backend reads the token from fcaptcha_token instead of g-recaptcha-response. From v1.45.0 the widget adds that field itself; on earlier versions, set it from the widget’s callback.

Try it

• Live demo
• Source and documentation on GitHub