The hCaptcha Alternative. For GDPR-conscious teams.

hCaptcha vs TrustSig, side by side

hCaptcha improved on reCAPTCHA's data handling and kept the visual puzzle. These rows cover friction, accessibility and residency.

The puzzle is what teams want gone

hCaptcha answered the reCAPTCHA data question. These are the ones it left open.

Replace hCaptcha in 5 minutes

Remove the hCaptcha widget and its verify endpoint, then add the scan and one verify call. Two npm packages, nothing else to install.

1. 01
   Frontend: remove the widget

   // Before: hCaptcha
   // <script src="https://js.hcaptcha.com/1/api.js" />
   // <div className="h-captcha" data-sitekey={SITE_KEY} />
   
   // After: TrustSig (no widget element)
   import { useTrustSig } from "@trustsig/react"
   
   function ActionForm() {
     const { getResponse } = useTrustSig()
   
     const handleSubmit = async () => {
       const response = await getResponse()
       await fetch("/api/action", {
         headers: { "X-TrustSig-Response": response?.token || "" },
       })
     }
   }

2. 02
   Backend: replace the verify call

   // Before: hCaptcha (network round-trip)
   // await fetch("https://api.hcaptcha.com/siteverify", ...)
   
   // After: TrustSig (one verify call at the edge)
   import { TrustSig } from "@trustsig/server"
   
   const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY })
   
   app.post("/api/action", async (req, res) => {
     const token = req.headers["x-trustsig-response"]
   
     const result = await ts.verifyRemote(token)
   
     if (result.action !== "ALLOW")
       return res.status(403).json({ error: "Blocked" })
   })

hCaptcha migration questions