reCAPTCHA vs hCaptcha vs Turnstile compared
By Nick Peplow ·
All three of these products do one job: decide whether the thing submitting your form is a person, without asking your visitors to prove it more than necessary. Where they differ is what they collect while deciding, how much friction they impose when unsure, and what they cost — and those differences are bigger than the near-identical integration snippets suggest.
One thing they share that’s worth stating up front, because skipping it makes any of the three worthless: the widget gives the browser a token, and your server must verify that token against the provider’s API using your secret key. A challenge that’s only checked client-side is decoration — bots POST straight past it.
How does each one decide you’re human?
reCAPTCHA is really three products. v2 is the “I’m not a robot” checkbox, escalating to image puzzles when Google’s risk analysis is unsure. Invisible v2 hides the checkbox and challenges only suspicious sessions. v3 abandons interaction entirely: every request gets a score from 0.0 (likely bot) to 1.0 (likely human), and you decide what to do with it. That last part is the operational cost teams underestimate — v3 hands you a score, not a decision. You pick the threshold, and you build the fallback path for a real user who scores 0.3, because “silently reject” is how legitimate submissions vanish without a trace. Since Google folded reCAPTCHA into Google Cloud in 2024, usage is metered there, with a free allowance of 10,000 assessments a month under Google’s current pricing.
hCaptcha was built as a drop-in reCAPTCHA replacement — same widget shape, same sitekey-and-secret flow, a token verified server-side — which made it the easy migration when Cloudflare publicly dropped reCAPTCHA for hCaptcha in 2020, citing privacy concerns and Google’s plans to start charging. The default experience is a visible challenge; passive and invisible modes that skip the puzzle for most users sit on the paid tiers. Today hCaptcha’s center of gravity is enterprise bot defense, with the free tier as the on-ramp.
Turnstile is Cloudflare’s 2022 answer to the same problem, built after they’d concluded — running one of the largest challenge platforms on the internet — that image puzzles weren’t worth their human cost. Turnstile runs a rotating set of non-interactive browser checks (proof-of-work among them) and never shows an image puzzle; the worst case a visitor sees is a checkbox to tick. On Apple devices it can accept Private Access Tokens, verifying device legitimacy without fingerprinting the user at all. It’s free, with paid tiers aimed at enterprise analytics rather than core function.
| reCAPTCHA | hCaptcha | Turnstile | |
|---|---|---|---|
| Interaction model | v2: checkbox + puzzles; v3: none (score only) | Visible challenge; passive on paid tiers | Non-interactive; checkbox at worst, never puzzles |
| Decision you get | Pass/fail (v2) or 0.0–1.0 score (v3) | Pass/fail token | Pass/fail token |
| Privacy posture | Data flows to Google; consent questions in the EU | Markets on minimal data collection | No tracking cookies; Private Access Token support |
| Pricing model | Metered via Google Cloud; 10k assessments/mo free | Free tier; passive modes and scale are paid | Free; enterprise tiers for analytics |
| Fits best | Teams already in Google’s ecosystem needing fraud tooling | reCAPTCHA-shaped integration without Google | Default for new builds |
Which one survives a privacy review?
This is where the three genuinely diverge.
reCAPTCHA works by recognizing humans, and recognizing humans means collecting signals — cookies, browser characteristics, interaction patterns — that flow to Google. That’s not a conspiracy reading; it’s the mechanism. The practical consequence for European traffic: France’s CNIL has taken the position that reCAPTCHA involves reading data from the user’s device in ways that require prior consent under ePrivacy rules. If your site runs a consent banner, reCAPTCHA belongs behind it — which is an awkward place for the thing guarding your contact form.
hCaptcha’s founding pitch was privacy: collect the minimum needed to tell humans from bots, don’t reuse it for advertising. That pitch is why Cloudflare chose it in 2020, and it remains the differentiator for sites that want a conventional CAPTCHA without wiring Google into every page view.
Turnstile makes the strongest claims of the three: no tracking cookies, no data harvested for ad targeting, and the Private Access Token path explicitly designed to verify without identifying. Cloudflare’s incentive structure supports the claim — Turnstile is a free product that exists to make the paid platform more attractive, not a data business.
What does each cost in real friction?
Friction isn’t just whether a puzzle appears — it’s what happens to the unlucky visitor.
The v2 checkbox with image puzzles is the worst honest case: users on VPNs, privacy browsers, or shared IPs get the fire hydrants, sometimes repeatedly. hCaptcha’s visible default is comparable. Turnstile’s worst case — a checkbox, briefly — is materially better.
reCAPTCHA v3 deserves its own warning. Zero UI sounds like zero friction, but a v3 deployment with a bad threshold produces the worst failure mode in this comparison: a real person whose message is rejected with no challenge to complete and no way to know why. Invisible until it isn’t, and then it’s invisible in the wrong direction. If you deploy v3, log scores before you enforce them, and give low scorers a v2 challenge rather than a dead end.
So which one?
For a new build with no existing constraints, Turnstile is the straightforward pick: free, near-zero friction, defensible privacy posture. Choose hCaptcha when you want a conventional challenge widget without Google, or when a compliance review has already blessed it. Choose reCAPTCHA when you’re deep in Google’s ecosystem anyway or you need the fraud-analysis tooling around reCAPTCHA’s enterprise tier — it’s the most mature product here, and for some risk profiles that maturity is worth the baggage.
The quieter question is whether your form needs any of them yet. A CAPTCHA is an escalation — the rung you climb to when invisible defenses are demonstrably losing, because every challenge taxes the humans for the bots’ behavior. FormWire supports all three per form — flip one on for the form that’s actually under attack, verification handled server-side — but the honeypot that’s on by default catches the bulk of automated spam before any challenge is needed, which is why many sites never flip the toggle at all.
The best CAPTCHA is the one your visitors never meet. Pick the provider for the attack you actually have, not the one whose logo you’ve seen most often.