The hCaptcha Alternative. For GDPR-conscious teams.

hCaptcha vs TrustSig — side by side

hCaptcha vs TrustSig compared across the things that actually drive a hCaptcha replacement: friction, accessibility, residency. A privacy step up from reCAPTCHA, but still a visual puzzle in front of your users — TrustSig removes the puzzle entirely.

Why teams move off hCaptcha

hCaptcha solved the reCAPTCHA data problem honestly. It did not solve the friction problem — the puzzle is still there.

Replace hCaptcha in 5 minutes

Remove the hCaptcha widget and verify endpoint. Drop in the invisible scan and a local verify. Two npm packages, no infrastructure changes.

1. 01
   Frontend — remove the widget

   // Before — hCaptcha
   // <script src="https://js.hcaptcha.com/1/api.js" />
   // <div className="h-captcha" data-sitekey={SITE_KEY} />
   
   // After — TrustSig (invisible, no widget element)
   import { useTrustSig } from "@trustsig/react"
   
   function ActionForm() {
     const { scan } = useTrustSig()
   
     const handleSubmit = async () => {
       const response = await scan()
       await fetch("/api/action", {
         headers: { "X-TrustSig-Response": response?.token || "" },
       })
     }
   }

2. 02
   Backend — replace the verify call

   // Before — hCaptcha (network round-trip)
   // await fetch("https://api.hcaptcha.com/siteverify", ...)
   
   // After — TrustSig (verified locally, zero latency)
   import { TrustSig } from "@trustsig/server"
   
   const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY })
   
   app.post("/api/action", async (req, res) => {
     const token = req.headers["x-trustsig-response"]
   
     const result = ts.verifyLocal(token)
   
     if (result.action === "BLOCK")
       return res.status(403).json({ error: "Blocked" })
   })

hCaptcha migration questions