Every form on the internet needs some way to tell a person apart from a bot, and almost nobody thinks hard about which one to use — you drop in whatever the framework's example uses and move on. It's worth ten minutes of actual thought, because the three main options make genuinely different tradeoffs on privacy, friction, and who you're trusting with the decision.
reCAPTCHA: the incumbent, and its cost
Google's reCAPTCHA is still the default a lot of people reach for, largely because it's the one they've seen the most. The tradeoff is that it routes your visitors' behavioral data through Google, on a third-party origin, to make a bot-or-not decision — and it's increasingly visible to privacy-conscious users and to anyone reading your site's network requests. For a business that talks about privacy and GDPR compliance elsewhere on its site, running Google's captcha in the background is a quiet contradiction.
Cloudflare Turnstile: the standard, done well
Turnstile is Cloudflare's answer, and it's a genuinely good one — invisible in most cases, low friction, backed by Cloudflare's own bot-detection signal rather than a visual puzzle. We used it for exactly that reason on TG Spaces, the studio-booking platform we built end-to-end for a Dutch creative venue: it's the standard, well-supported solution for a production booking flow where reliability matters more than making a philosophical point about third parties. If you're already on Cloudflare's network, or you just want the most battle-tested option with the least setup risk, Turnstile is a reasonable default.
Altcha: self-hosted, no third party at all
For this site, we went a different direction: Altcha, a self-hosted proof-of-work captcha. Instead of sending visitor behavior to a third party for a verdict, Altcha issues a cryptographic puzzle that the visitor's browser solves locally — cheap for a real browser, expensive enough to discourage naive bot scripts, and with no external origin involved at all. It's not the right fit for every situation (it doesn't have Cloudflare's years of adversarial tuning against sophisticated bots), but for a marketing site's contact form and chat gate, "no third-party origin, ever" was worth more to us than marginal bot-detection accuracy.
So which one should you use?
- High-stakes, high-traffic, production booking or payment flows — lean toward Turnstile or reCAPTCHA Enterprise. You want the vendor with the most adversarial data.
- A marketing site, contact form, or anything where "no third party sees this" is part of your actual positioning — a self-hosted option like Altcha is worth the extra setup.
- Whatever you pick, don't rely on it alone. Every hardened form on this site pairs its captcha with a honeypot field, rate limiting, and server-side re-validation — because a captcha is one layer, not the whole defense.
The real decision isn't "which captcha is best." It's "what am I actually trying to protect, and who am I comfortable trusting with the answer."