Invisible CAPTCHA: What It Is and How It Works

What is an invisible CAPTCHA?

An invisible CAPTCHA is a bot check that runs in the background instead of asking the visitor to solve a puzzle or tick a box. It looks at signals from the browser, a bot score or the result of a small computation, and your server decides whether the request goes through.

“Invisible” describes what the visitor experiences. Technically there is still a challenge, a response and a server check, as with every CAPTCHA; if you want those basics first, read what is a CAPTCHA. The difference is who does the work. With a traditional CAPTCHA the visitor does: types letters, clicks tiles, ticks a box. With an invisible one the browser does, while the visitor fills in the form.

Some products show nothing at all. Others keep a small widget or badge on the page that says a check is running, even though nobody has to do anything.

How does an invisible CAPTCHA work?

Most invisible CAPTCHAs run the same five steps:

1. A script loads with the page or the form and starts the check on its own.
2. In the background, it collects signals from the browser, solves a proof-of-work puzzle, or both.
3. The result is wrapped in a signed token and added to the form.
4. When the form is sent, your server asks the provider whether the token is genuine and gets back a pass or fail, a bot score, or both.
5. Your application lets the request through, asks for another check or blocks it.

Steps 4 and 5 are where the security comes from. A check that only runs in the browser can be skipped by a bot that posts the form directly.

What the background check looks at

Score-based systems read signals that separate people from automation:

• the browser and device: whether the environment is consistent and whether it shows traces of automation tools;
• behavior on the page: timing, typing, how the form was filled in;
• the session: repeated attempts, unusual navigation, how often forms are sent;
• the network: the IP address and what is known about it.

No single signal proves anything. The combination becomes a bot score, and your server decides what to do with it. The methods behind it are covered in our guide to bot detection.

Proof-of-work: a cost on every request

Proof-of-work CAPTCHAs take a different route. The browser solves a small cryptographic puzzle before the form goes out. For one visitor that is a moment of computing time. For a bot that wants to send ten thousand requests, it is ten thousand puzzles, and the attack stops paying off. Some products, TrustCaptcha among them, combine both: the bot score decides how hard the puzzle gets.

Traditional vs invisible CAPTCHA

A traditional CAPTCHA asks the visitor to prove something: type distorted text, pick image tiles or tick a checkbox. An invisible CAPTCHA does its check in the background and asks for nothing, or falls back to a task only when it is unsure. In both cases the security comes from your server validating a token. What changes is who carries the cost: the visitor or the bot.

If you have to choose, our view is simple: a visitor should only ever see a task when the background check cannot decide, and on most forms that should be rare.

reCAPTCHA invisible mode: v2 invisible and v3

Google offers two ways to run reCAPTCHA without the checkbox, and they behave differently.

reCAPTCHA v2 invisible

v2 invisible removes the “I’m not a robot” checkbox. The check runs when the visitor presses the submit button, or when your code calls it, and a small reCAPTCHA badge appears in the corner of the page instead. In the HTML you switch it on with data-size="invisible"; when you render the widget with JavaScript, the option is size: 'invisible'. If you searched for mode: 'invisible': Google’s API calls this setting size, not mode.

Invisible here means no checkbox. It does not mean no challenge. If the risk analysis is unsure, the visitor still gets an image grid, just as with the checkbox version, and your server receives a token that is valid or not.

reCAPTCHA v3

v3 score keys never show a challenge. The script runs in the background on the pages and actions you name, and your server gets a score from 0.0 (very likely a bot) to 1.0 (very likely good). What happens to a low score is up to you. Google documents 0.5 as the default threshold and suggests extra verification below it, such as a second factor or an email check. If you want Google to show a challenge below your threshold after all, policy-based challenge keys do that; they have been generally available since 28 October 2025.

Both variants set the _GRECAPTCHA cookie and are billed as assessments, with the first 10,000 a month free per organization. The full comparison is in reCAPTCHA v2 vs v3, and what the v3 number means is explained in our guide to the reCAPTCHA score.

Which CAPTCHA vendors offer an invisible option?

Most of them do, but the conditions differ: on some plans the visitor still gets a task, and some invisible modes cost extra.

Two questions sort this list quickly. Does the visitor ever see a task, and on which plan? And where does the data go? Our best CAPTCHA comparison weighs the options on friction, privacy and price. If you would rather protect forms without a CAPTCHA at all, the overview of CAPTCHA alternatives covers honeypots, rate limits and the rest.

Are invisible CAPTCHAs really invisible?

Often not completely. Many invisible products keep a fallback: when the check is unsure, the visitor gets a checkbox or an image grid after all. That tends to hit the same people every time: VPN users, corporate networks, privacy-hardened browsers, people with script blockers or assistive tools.

Two numbers tell you how invisible a product is on your site. The challenge rate is the share of visitors who see any task at all. The false positive rate is the share of real visitors who are slowed down or blocked. Ask the vendor for both, or measure them during a trial.

Some products also stay visible as a widget or badge when nobody has to do anything. That is a design choice. A visible widget tells the visitor that a check is running, and plenty of site owners prefer it that way.

Invisible does not mean private

A background check needs data to work with, and an invisible CAPTCHA can collect more than a puzzle does, simply because the visitor never sees it happen. Before you choose one, look at four things: which signals it collects, whether it sets cookies, where the data is processed and what contract you sign with the provider.

A cookie-free check, processed in the EU and covered by a Data Processing Agreement, avoids the usual questions; that is the profile of a GDPR-compliant CAPTCHA. This section is not legal advice. How the rules apply to your setup is a question for your data protection officer.

TrustCaptcha: an invisible CAPTCHA from the EU

TrustCaptcha checks visitors in the background with proof-of-work and bot scoring. The visitor has nothing to solve and nothing to click, because the widget starts on its own. The browser solves a proof-of-work puzzle whose difficulty rises with the risk of the request, so a suspicious bot pays more than a regular visitor. Bot detection and risk scoring come with the Solo plan and above; the Hobby plan uses proof-of-work alone.

By default the widget stays visible as a small box that shows the check is running. If you want no visible widget at all, the Captcha Branding add-on makes it fully invisible and removes our branding.

TrustCaptcha sets no cookies, processes data in EU data centers and includes a Data Processing Agreement for every customer.

Try TrustCaptcha

Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial and take the puzzle off your forms.