What is the best CAPTCHA?
There is no single best CAPTCHA, only the one that fits what you weigh most. If price decides, Cloudflare Turnstile is hard to beat: it is free with unlimited challenges. reCAPTCHA makes sense if you already work in Google Cloud and want a risk score you can tune, and if data should stay in the EU while visitors solve nothing, TrustCaptcha and Friendly Captcha fit best.
hCaptcha is the odd one out. Its free plan always shows image challenges, and the passive mode that hides them costs $99 a month billed yearly. That works for teams who want a familiar challenge without Google, and less well for teams whose main goal is fewer clicks on the signup form.
This page compares the five providers most teams shortlist. If you are leaving Google in particular, our list of reCAPTCHA alternatives goes through seven options, including open-source ones you run yourself.
CAPTCHA comparison: five providers side by side
The table puts the five next to each other on the points that usually decide.
| Google reCAPTCHA | hCaptcha | Cloudflare Turnstile | Friendly Captcha | TrustCaptcha | |
|---|---|---|---|---|---|
| Visible challenge | v2: checkbox, image grids when unsure; v3: none | Image challenges on the free plan; passive mode from Pro | No puzzle; managed mode can show a checkbox | None (proof-of-work) | None (proof-of-work) |
| Cookies | Yes, _GRECAPTCHA, labeled necessary | Yes, labeled strictly necessary | Not stated for the widget | None | None |
| Company based in | USA | USA | USA | Germany | Germany |
| Data processed in | Varies, needs a legal review | Any country, including the USA | Varies, needs a legal review | EU endpoint from the Advanced plan | EU data centers |
| Free tier | 10,000 assessments a month per organization | Basic plan, $0 | Unlimited challenges, up to 20 widgets | Non-commercial sites, 1,000 requests a month | Non-commercial sites, 500 verifications a month |
| Paid from | $8 a month flat fee up to 100,000 | $99 a month billed yearly (Pro) | Enterprise, on request | €9 a month (Starter, 1,000 requests) | €8 a month (Hobby, 1,000 verifications) |
Prices are per month: reCAPTCHA and hCaptcha in USD, Friendly Captcha and TrustCaptcha in EUR. TrustCaptcha prices exclude VAT. hCaptcha Pro costs $139 billed monthly.
hCaptcha vs reCAPTCHA
Both are US services, and both can put an image grid in front of your visitors. The difference is how often. reCAPTCHA v2 shows images only when it is unsure, and v3 never does: it scores each request from 0.0 to 1.0 and leaves the decision to your server. hCaptcha’s free Basic plan runs in “Always Challenge” mode, so every visitor gets a task; the 99.9% passive mode starts with Pro, and risk scores come with Enterprise. On price, reCAPTCHA is free up to 10,000 assessments a month per organization, while hCaptcha Pro includes 100,000 evaluations and then charges $0.99 per 1,000.
More detail is in our guides to hCaptcha alternatives and reCAPTCHA v2 vs v3.
reCAPTCHA vs Turnstile
If you searched for Cloudflare vs reCAPTCHA, this is the comparison you mean: Turnstile is Cloudflare’s CAPTCHA, and it works without any other Cloudflare service. On price it wins clearly, with unlimited challenges on the free plan. reCAPTCHA is free up to 10,000 assessments a month for your whole Google Cloud organization, then charges an $8 flat fee up to 100,000 and $1 per 1,000 above that. What you get for the money is a risk score you can tune per action, although the free Essentials tier returns only four score levels. Turnstile never shows image puzzles, at most a checkbox in managed mode, and on data neither is ahead: Cloudflare is a US company and reCAPTCHA data goes to Google, so with both the transfers need a legal review.
The numbers behind the reCAPTCHA bill are in reCAPTCHA pricing, and the options beyond Turnstile in Cloudflare Turnstile alternatives.
hCaptcha vs Turnstile
Turnstile shows no image challenges on any plan, while hCaptcha’s free plan always does. To get hCaptcha close to that, you need its passive mode from Pro at $99 a month billed yearly, and Turnstile stays free. For accessibility, Cloudflare claims WCAG 2.2 AA for Turnstile, and hCaptcha offers text challenges and email verification as alternatives to images. Both are US companies that rely on the EU-U.S. Data Privacy Framework for transfers. hCaptcha says it may process data in any country, including the USA, so with either provider the transfers need a legal review.
Which CAPTCHA has the least user friction?
The ones that never show a task. Proof-of-work CAPTCHAs such as TrustCaptcha and Friendly Captcha let the browser do a small computation instead, reCAPTCHA v3 scores visitors in the background, Turnstile can run in non-interactive or invisible mode, and hCaptcha’s passive mode needs a paid plan.
Image challenges add the most friction and shut out visitors who cannot see them. A checkbox sits in between: one click, but every visitor notices it. A quiet CAPTCHA can still leave work on your side. reCAPTCHA v3 hands your server a score and nothing else, so you decide what happens at 0.3. More on how this works in invisible CAPTCHA.
Which CAPTCHA suits login and registration at high traffic?
Login and signup forms see the attacks that come in volume: credential stuffing, fake accounts and brute force. Three questions matter there. Can the CAPTCHA make suspicious requests more expensive instead of treating every visitor the same? Does your server get a score or rules it can act on? And what does the volume cost?
reCAPTCHA charges $1 per 1,000 assessments above 100,000, and hCaptcha Pro $0.99 per 1,000 above the 100,000 it includes. Turnstile stays free. TrustCaptcha raises the proof-of-work difficulty with the risk of each request, and adds bot detection, risk scoring and custom rules from the Solo plan. One reCAPTCHA detail is worth knowing before a traffic spike: above the free tier without billing set up, its check fails open. It returns success with a score of 0.9 and only adds an error message, so a backend that only reads success and the score lets every request through.
For the attack side, see how to prevent fake account creation and our page on brute force protection. If data protection decides, start with the GDPR-compliant CAPTCHA.
Try TrustCaptcha
Every TrustCaptcha plan starts with a 14-day free trial, and non-commercial sites can use it for free. Start your free trial and run it next to your current CAPTCHA on one form before you switch the rest.
