In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript.

I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third-party domain. With JavaScript spamfilters you are loading them from the first-party domain.

reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

I don't think the noscript alternative works anymore. I get this message "Please enable JavaScript to get a reCAPTCHA challenge."

https://www.google.com/recaptcha/api2/demo

Huh, last time I hit a cloudflare website on Tor it directed me to https://www.google.com/recaptcha/api/fallback?k=...

Perhaps that's just a cloudflare thing.

That I didn't know. I don't remember ever seeing it, I suppose it is not used much?

I can't think of any reason why js would be disabled in a browser other than by personal choice? In which case you're making the website unusuable for yourself.

It's often disabled by people who use screen readers, or by users who care about their privacy.

If your regular website (not a webapp) doesn't work without JS, then you're failing as a dev.