--- title: "Cloudflare Turnstile vs reCAPTCHA vs hCaptcha (2026): Which CAPTCHA?" description: "reCAPTCHA is free only to 10,000 checks a month, then can quietly pass every bot. Turnstile, reCAPTCHA and hCaptcha compared on free limits, privacy and cost." source: https://appstackbuilder.com/blog/cloudflare-turnstile-vs-recaptcha-vs-hcaptcha-2026 retrieved: 2026-10-24 --- [Back to Blog](https://appstackbuilder.com/blog) Security2026 Guide # Cloudflare Turnstile vs reCAPTCHA vs hCaptcha in 2026 **Cloudflare Turnstile** is free at any volume with no puzzles; **reCAPTCHA** gives a tunable score but is free only up to 10,000 checks a month, after which its classic check can pass every bot; **hCaptcha** leads on privacy compliance, with its low-friction mode on the $99 Pro plan. 12 min read3 tools compared, 1 challengerPublished October 24, 2026 ## Key takeaways * reCAPTCHA now runs through Google Cloud. The free Essentials tier covers 10,000 assessments a month; Standard is $8 a month up to 100,000. * Over the free quota without billing, reCAPTCHA’s SiteVerify check fails open: it returns success with a score of 0.9, so bots can look human. * Cloudflare Turnstile is free with unlimited challenges, shows no image puzzles and does not require Cloudflare DNS. * hCaptcha’s Basic plan is free; Pro is $99 a month on yearly billing with 100,000 evaluations and a 99.9% passive mode. * No CAPTCHA stops every bot. Pair it with server-side verification, rate limits and email verification before granting anything costly. ## Why does a small SaaS need bot protection? Bots find a public form within days of launch. On a contact form that means spam. On a signup form with a free tier it means fake accounts that burn your free credits, your transactional email quota and — if your product calls an LLM — real money per request. Bot protection puts a check between the form and your server. A small script in the browser collects signals, the provider decides whether the visitor looks human, and your server verifies the resulting token before doing anything costly. The three tools here all work that way; they differ in what they ask of the user, what they learn about them, and what they charge. ### Keep free tiers for real users Scripted signups that claim free credits cost you compute, email sends and API calls. A check at signup stops most of them before they exist. ### Protect your email reputation Fake signups with real victims' addresses trigger confirmation emails those people never asked for. Enough complaints and your domain lands in spam folders. ### Slow down credential stuffing Login forms see lists of leaked passwords replayed at scale. A challenge on repeated failures makes that expensive for the attacker. ### Stop card testing Checkout forms get used to test stolen cards in small amounts. The disputes and processor fees land on you, and so can a payment-account review. **What it does not do:** no CAPTCHA stops a determined attacker. Solver services and browser-automation agents get through some share of challenges. Bot protection raises the cost of abuse; it does not replace rate limits, email verification, or limits on what a brand-new account can do. **Do you need this yet?** If your form only sends you an email, a hidden honeypot field and a rate limit may be enough for a while. Add real bot protection the day a signup triggers something that costs money — free credits, an LLM call, an SMS, a trial server — or the first time you see a spike of signups that never log in again. ## Quick Verdict ![](https://appstackbuilder.com/cloudflare.svg)Cloudflare Turnstile Free with unlimited challenges, no image puzzles, and no need to use any other Cloudflare service. Returns pass or fail rather than a score. Unlimited freeNo puzzles ![](https://www.google.com/s2/favicons?domain=google.com&sz=128)Google reCAPTCHA The most widely deployed, and the only one here that gives every plan a 0–1 risk score you can tune. Now a Google Cloud product with a 10,000-a-month free tier. Tunable score10K free/mo ![](https://www.google.com/s2/favicons?domain=hcaptcha.com&sz=128)hCaptcha Privacy-first challenges with a free Basic plan, a 99.9% passive mode on Pro, and compliance claims covering GDPR, CCPA, LGPD and PIPL. Privacy focusPro from $99/mo TL;DR No single winner — pick on your constraint. Free at any volume with no puzzles → **Turnstile**. A risk score you tune per action, inside Google Cloud → **reCAPTCHA** (and turn billing on). Privacy compliance and an adjustable challenge → **hCaptcha**. Abuse that comes through your API rather than a form → look at **Arcjet** below. ## What happens when reCAPTCHA goes over 10,000 checks? Google moved every classic reCAPTCHA key into Google Cloud. Its migration guide sets the schedule as automated migration starting in Q4 2025 and completing in Q1 2026, so if you set up reCAPTCHA years ago and never touched it, your key is now a Google Cloud key with a free tier of 10,000 assessments a month. That is roughly 330 checks a day. A modest SaaS with a protected signup, login and contact form can pass it. What happens next depends on which API your server calls. ### SiteVerify — fails open The classic verification endpoint most tutorials use. Google's docs: over-quota requests "return `success:true` with a score of `0.9`, and the API response will include an error message indicating that you exceeded the quota." If your code only checks `success` and `score`, every bot now looks human. ### CreateAssessment — fails closed The newer Google Cloud API. Over-quota requests return a `429 Resource Exhausted` error and no assessment. If your code treats an error as "block", real users get locked out until next month; if it treats it as "allow", you are back to failing open. **If you stay on reCAPTCHA:** enable billing on the Google Cloud project (Standard is $8 a month up to 100,000), make sure the over-quota emails reach someone, and add a check for the quota error field in your verification code. A score of exactly 0.9 alongside an error is not a human. ## How do Turnstile, reCAPTCHA and hCaptcha compare? Plans and limits as published by each vendor in October 2026\. All three use the same integration shape — a browser widget that issues a token and a server call that verifies it — so switching is mostly a matter of keys and URLs. Unlimited on free ![](https://appstackbuilder.com/cloudflare.svg) ### Cloudflare Turnstile Free, puzzle-free challenges $0, unlimited challenges Enterprise: contact sales * Free: unlimited challenges, up to 20 widgets per account * Up to 10 hostnames per widget on free, 200 on Enterprise * Pre-clearance on free; ephemeral IDs on Enterprise * Works without Cloudflare DNS or any other Cloudflare service * WCAG 2.2 AAA conformance listed on both plans * Remove Cloudflare branding on Enterprise only * CaveatIt returns pass or fail, not a risk score, so you cannot tune a threshold per action. Analytics look back only 7 days on the free plan. Best for: Most startups: signup, login and contact forms at any volume, with no bill and no puzzles. Risk score on every plan ![](https://www.google.com/s2/favicons?domain=google.com&sz=128) ### reCAPTCHA Google’s risk scoring, now in Google Cloud $0 up to 10K/mo Standard $8/mo up to 100K; Enterprise $1 per 1,000 * Essentials: 10,000 assessments a month free * Standard: $8 a month for up to 100,000 assessments * Enterprise: $1 per 1,000 on a fixed monthly commitment, 12-month minimum * v3 returns a 0.0–1.0 score per action; v2 offers the checkbox * Requires a Google Cloud project; billing needed above the free tier * CaveatOver quota, SiteVerify fails open with a score of 0.9\. Also loads Google scripts on your page, which matters for privacy reviews and cookie-consent banners in the EU. Best for: Teams already on Google Cloud who want a score to tune per action — and who will switch billing on. Compliance focus ![](https://www.google.com/s2/favicons?domain=hcaptcha.com&sz=128) ### hCaptcha Privacy-first, challenge-based $0 Basic Pro $99/mo yearly ($139 monthly), 100K evals included * Basic: free bot protection, works in every country * Pro: 99.9% passive mode, custom themes, analytics * Pro overage: $0.99 per 1,000 evaluations past 100K * Enterprise: risk scores, no-CAPTCHA passive mode, SSO, SLAs * Lists GDPR, CCPA, LGPD and PIPL compliance * 14-day free trial of Pro * CaveatThe free Basic plan shows visual challenges more often than the other two; the low-friction passive mode is a paid feature. Risk scores are Enterprise-only. Best for: Products with strict privacy requirements, or teams who want challenges they can tune harder or softer. ## How much does each CAPTCHA cost? A check is one verification: one signup, one login attempt, one form post. List prices, October 2026. | Monthly volume | ![](https://appstackbuilder.com/cloudflare.svg)Cloudflare Turnstile | ![](https://www.google.com/s2/favicons?domain=google.com&sz=128)reCAPTCHA | ![](https://www.google.com/s2/favicons?domain=hcaptcha.com&sz=128)hCaptcha | | ----------------- | ---------------------------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | 5,000 checks/mo | $0 | $0 (Essentials) | $0 (Basic) | | 50,000 checks/mo | $0 | $8 (Standard) | $0 Basic, or $99 for passive mode | | 500,000 checks/mo | $0 | \~$500 (Enterprise, 12-mo commitment) | $0 Basic, or \~$495 on Pro | **How we got these:** reCAPTCHA past 100,000 moves you to Enterprise pricing at $1 per 1,000 on a 12-month commitment, so 500,000 is about $500 a month. hCaptcha Pro at 500,000 is $99 plus 400,000 × $0.99 per 1,000, about $495 on yearly billing; the free Basic plan still works at that volume, with more visible challenges. Cutting checks to the actions that matter — signup and repeated failed logins, not every page — lowers all three. ## Feature comparison Capability ![](https://appstackbuilder.com/cloudflare.svg)Cloudflare Turnstile ![](https://www.google.com/s2/favicons?domain=google.com&sz=128)reCAPTCHA ![](https://www.google.com/s2/favicons?domain=hcaptcha.com&sz=128)hCaptcha Free tier Unlimited 10K/mo Basic plan Low-friction mode on free plan ✓ v3 (invisible) Pro only Image puzzles ✗ v2 fallback ✓ Risk score to tune ✗ ✓ Enterprise Needs another product No Google Cloud project No Over the limit No limit Fails open / 429 Billed overage Remove vendor branding Enterprise Hide badge with notice Custom themes (Pro) ## Challengers worth knowing Not all abuse comes through a form a person fills in. ![](https://www.google.com/s2/favicons?domain=arcjet.com&sz=128)Arcjet A security SDK that runs in your server code instead of a widget in the browser: rate limiting, a Shield WAF, and protection for AI-agent endpoints. Free for 10,000 requests a month, then $25 a month plus $5 per million web requests. A layer behind a CAPTCHA, or instead of one for APIs. ### Proof-of-work CAPTCHAs Friendly Captcha and the open-source ALTCHA make the visitor's browser solve a small computation instead of a puzzle, with no tracking. Popular with EU teams that want to avoid a cookie-consent question entirely. ## Which one should you pick? ### You want it free, at any volume, with no puzzles **Cloudflare Turnstile.** Unlimited challenges, no Cloudflare DNS needed, and users rarely see anything. Accept that you get pass or fail, not a score. ![](https://appstackbuilder.com/cloudflare.svg)Cloudflare Turnstile ### You want a score per action and already run on Google Cloud **reCAPTCHA.** Use different thresholds for signup, login and checkout, and step up to a second factor on low scores. Turn billing on and handle the over-quota error before you rely on it. ![](https://www.google.com/s2/favicons?domain=google.com&sz=128)reCAPTCHA ### Privacy review or regulation is your hardest constraint **hCaptcha**, or a proof-of-work option. hCaptcha documents compliance across GDPR, CCPA, LGPD and PIPL; Pro removes most visible challenges. Run it past your privacy reviewer before you commit either way. ![](https://www.google.com/s2/favicons?domain=hcaptcha.com&sz=128)hCaptcha ### The abuse is hitting your API, not your forms A widget cannot protect an endpoint a script calls directly. Put rate limits and bot rules in the server with **Arcjet** or your platform's WAF, and keep a CAPTCHA only where a human fills in a form. ![](https://www.google.com/s2/favicons?domain=arcjet.com&sz=128)Arcjet ## How do you add a CAPTCHA safely? 1. 1. Verify on the server, every time A widget in the browser proves nothing until your server checks the token with the provider. Bots skip the widget and post straight to your endpoint. 2. 2. Check the hostname and action Confirm the token was issued for your domain and for this form, so a token solved on one page cannot be replayed on another. 3. 3. Decide what an error means Write down whether a provider error blocks or allows. For reCAPTCHA, read the quota error field rather than trusting success and score alone. 4. 4. Rate limit the endpoint too Limit signups per IP and per email domain. A CAPTCHA raises the cost per attempt; a rate limit caps the number of attempts. 5. 5. Gate the expensive part Grant free credits or start trials only after email verification, so a bot that gets through still gets nothing of value. ## Bot protection is one line of the stack Use our AI-powered generator to build a complete stack — auth, email, payments, bot protection, monitoring — sized to your budget and your team. [Generate Your Tech Stack](https://appstackbuilder.com/build-stack?budget=50&appType=saas&teamSize=small) ## Frequently Asked Questions ### Which is best in 2026: Cloudflare Turnstile, reCAPTCHA or hCaptcha? There is no single best one — they differ on price, on what data they collect and on how they decide. Turnstile is free with unlimited challenges, never shows image puzzles and returns a simple pass or fail. reCAPTCHA gives you a risk score to tune, but now needs a Google Cloud project and is free only up to 10,000 assessments a month. hCaptcha is built around privacy compliance and challenges, with a near-passive mode on its paid Pro plan. Pick on whichever of those three constraints matters most to you. ### Is reCAPTCHA still free? Up to 10,000 assessments a month. Google moved all reCAPTCHA keys into Google Cloud, finishing the automatic migration in early 2026\. The free Essentials tier covers 10,000 assessments a month; the Standard tier is $8 a month for up to 100,000; Enterprise is priced at $1 per 1,000 assessments on a fixed monthly commitment with a 12-month minimum. Usage above the free tier requires billing enabled on the Google Cloud project. ### What happens when reCAPTCHA goes over the free quota? It depends on the API you call. Google’s documentation says SiteVerify requests over quota "fail open": they return success:true with a score of 0.9 and an error message in the response. CreateAssessment requests "fail closed" with a 429 error and no assessment. So a site using the classic SiteVerify check, without billing enabled, can keep accepting every submission as human after it passes 10,000 checks in a month unless its code reads the error field. ### Is Cloudflare Turnstile really free? Yes. Cloudflare’s plan page lists unlimited challenges on the free plan, with a limit of 20 widgets per account and 10 hostnames per widget. Enterprise adds unlimited widgets, ephemeral IDs, any-hostname widgets and removal of Cloudflare branding. Turnstile does not require your DNS or any other Cloudflare service. ### How much does hCaptcha cost? The Basic plan is free. Pro is $99 a month billed yearly or $139 billed monthly, with 100,000 evaluations included and $0.99 per 1,000 after that, and adds the 99.9% passive mode, custom themes and analytics. Enterprise is quoted by sales and adds risk scores, a fully passive no-CAPTCHA mode, SSO and SLAs. Pro has a 14-day free trial. ### Do CAPTCHAs stop AI agents and bots in 2026? Not on their own. They raise the cost of abuse, which is usually enough for signup and contact forms, but solver services and browser-automation agents can get through. Treat a CAPTCHA as one layer: add server-side rate limiting, email verification before granting anything costly such as free credits, and limits on what a new account can do in its first hours. ### Can I switch from reCAPTCHA to Turnstile easily? Usually in under an hour. Both use the same shape: a client-side widget that produces a token, and a server-side call that verifies it. Swap the script tag and site key on the client and the verification URL and secret on the server. The one design change is that Turnstile returns pass or fail, not a 0–1 score, so any threshold logic you built on reCAPTCHA v3 scores goes away. ## Sources Plans and quota behaviour were read from the vendor pages below on October 24, 2026. * [Google Cloud: reCAPTCHA Classic to reCAPTCHA Enterprise migration overview](https://docs.cloud.google.com/recaptcha/docs/migration-overview) * [Google Cloud: compare reCAPTCHA tiers](https://docs.cloud.google.com/recaptcha/docs/compare-tiers) * [Cloudflare Turnstile plans](https://developers.cloudflare.com/turnstile/plans/) * [hCaptcha pricing](https://www.hcaptcha.com/pricing) * [Arcjet pricing](https://arcjet.com/pricing) ### Related Articles [Clerk vs Auth0 vs Supabase AuthThe signup flow you are protecting](https://appstackbuilder.com/blog/clerk-vs-auth0-vs-supabase-auth)[Resend vs SendGrid vs PostmarkKeeping your sending reputation clean](https://appstackbuilder.com/blog/resend-vs-sendgrid-vs-postmark-2026)[Best AI Guardrails 2026Abuse that reaches your LLM anyway](https://appstackbuilder.com/blog/best-ai-guardrails-tools-2026) ### Explore More [All Blog Posts](https://appstackbuilder.com/blog)[Bot Protection Tools](https://appstackbuilder.com/categories/bot-protection)[Turnstile vs reCAPTCHA](https://appstackbuilder.com/compare/cloudflare-turnstile-vs-google-recaptcha)[Stack Generator](https://appstackbuilder.com/build-stack)