ALTCHA: the sovereign captcha that replaces reCAPTCHA and Turnstile

Every public form ends up attracting bots: commercial spam, link injection, fake sign-ups. The reflex answer is to add a captcha, and nine times out of ten that captcha is Google reCAPTCHA. This reflex has a cost few sites measure: every time the form is displayed, it is your visitor who is sent to an American third party, with their IP address, their browser and their behaviour. Here is why we replaced all that with ALTCHA, a self-hosted open-source anti-spam tool, and how it performs in production on our forms.

What a conventional captcha really does #

A modern captcha no longer asks you to copy twisted letters: it watches. reCAPTCHA v3 assigns a trust score by analysing the IP address, the Google cookies already in the browser, mouse movements, typing speed and the browser fingerprint. To tell a human from a bot, it has to profile the human: that is the very principle of the product.

All of this information goes to the captcha vendor. The contact form of an Alsatian SME thus becomes, without anyone really deciding it, a collection point for an American advertising platform. And contractually, that vendor becomes a processor within the meaning of the GDPR: it must appear in your privacy policy, with a transfer of data outside the European Union that needs a legal basis.

reCAPTCHA: the legal problem is documented #

This is not a theoretical worry. In its Cityscoot decision of March 2022 (SAN-2022-003), the CNIL, the French data protection authority, found that reCAPTCHA reads and writes information on the user’s device for purposes that are not strictly necessary to the service, and therefore requires the visitor’s prior consent, like an advertising cookie. In practice: a reCAPTCHA deployed without collecting consent puts the site in breach, and a reCAPTCHA with consent raises an absurd question: what do you do with the visitor who refuses? Bar them from the contact form?

Then come the usual complaints: accessibility (image puzzles are an ordeal for visually impaired people), friction (selecting pedestrian crossings to send a message), and the business model: the free version of reCAPTCHA has been capped at 10,000 assessments a month since 2024, beyond which you pay. Google’s “free” is paid for twice: first with your visitors’ data, then with an invoice.

Turnstile: better, but still not on your own server #

Cloudflare Turnstile is the market’s “privacy” answer: no puzzle, no advertising cookie, and it is free. It is objectively better than reCAPTCHA, and we had in fact chosen it at first for this site. But the structural problem remains: Cloudflare is a company under US law, and therefore within the scope of the Cloud Act. The script loads from their servers, verification goes through their infrastructure, and Cloudflare remains a processor to declare, whose terms, changes and actual telemetry you do not control.

The question is not “is this third party virtuous today?” but “why a third party at all?”. An anti-spam tool has no technical reason to let a single piece of data leave your server.

ALTCHA: proof of work instead of profiling #

ALTCHA (MIT licence, public source code) turns the problem around. Rather than proving the visitor is human by spying on them, it makes spam expensive for a machine: this is the proof of work mechanism, the same principle that protects other distributed systems against abuse.

1. Your server issues a challenge: a cryptographic hash (SHA-256) built from a random salt and a secret number, all signed with HMAC using a key only your server knows.
2. The visitor’s browser searches for the number by brute force, in the background, while the visitor calmly fills in the form. No interaction: no box to tick, no traffic lights to identify.
3. The solution is sent with the form; the server verifies it with HMAC in a few milliseconds, marks the challenge as used (replay protection) and processes the message.

// GET /api/altcha/challenge: what the browser receives
{
  "algorithm": "SHA-256",
  "challenge": "af5c…",   // the hash to reverse
  "salt": "a3d8…",        // random salt + expiry
  "signature": "9b1f…"    // HMAC: the server will recognise its own challenge
}

A legitimate visitor pays this cost once, without noticing. A spammer hitting ten thousand forms has to pay it ten thousand times: it is their business model under attack, not their ability to click on bicycles.

What it changes for compliance #

• No requests to a third party: the challenge is issued and verified by your server. Nothing leaves.
• No cookies, no fingerprinting: no consent to collect, no banner to lengthen.
• One processor fewer in the privacy policy: for us, the switch removed Cloudflare from the list.
• Accessible: no visual riddle, nothing for the visitor to solve; the widget complies with WCAG and is translated into French.
• Auditable: the code is open source and the mechanism fits on one page; compare that with an opaque score returned by a black box.

In production on our side: the figures #

We have deployed ALTCHA on the forms we operate, this site included, where it replaced Turnstile. Two settings are worth sharing, because the documentation does not highlight them enough.

The proof-of-work cost can be tuned. The work asked of the browser grows quadratically with the cost parameter. The value in the official examples (5,000) means around ten seconds of single-threaded computation, unacceptable on an entry-level phone. We measured it, then lowered it to 1,000: about 430 ms at the median, spread over several Web Workers, and the computation starts when the form loads. By the time the visitor has written their message, the proof was done long ago.

A challenge is single-use and time-stamped. Ours expires after 30 minutes (enough to write a long message without seeing it expire), and a solution already used is rejected (replay protection). As for secrets, there is a single HMAC key to manage in the secrets manager: no account with a provider, no site key, no third-party dashboard.

reCAPTCHA, Turnstile, ALTCHA: the decision table #

• Visitor data sent to a third party. reCAPTCHA: yes, to Google (US) · Turnstile: yes, to Cloudflare (US) · Self-hosted ALTCHA: no.
• GDPR consent required. reCAPTCHA: yes (CNIL position) · Turnstile: grey area, processor to declare · ALTCHA: no, no personal data processed.
• Interaction asked of the visitor. reCAPTCHA: sometimes puzzles · Turnstile: rarely · ALTCHA: never.
• Availability dependency. reCAPTCHA and Turnstile: their outage breaks your forms · ALTCHA: everything is on your side.
• Cost. reCAPTCHA: free up to 10,000 assessments a month · Turnstile: free (for as long as Cloudflare decides) · ALTCHA: free, for ever (it is your server).

The verdict #

A third-party captcha is a piece of your site that you do not own, plugged into your visitors’ data. ALTCHA proves you can protect a form without profiling anyone, without an extra processor and without an invoice waiting in the wings, at the cost of half a second of invisible computation. It is the same logic we apply to the rest of the chain: cookie-free analytics with self-hosted Matomo, sovereign hosting in France, and now spam protection.

Do you want to remove Google or Cloudflare from your forms without opening the door to spam? We have done it on our sites and on our clients’ sites: let us talk about yours.