Turnstile vs reCAPTCHA vs hCaptcha: Full Comparison (2026)

Three tools dominate this decision, and most comparisons of them end in adjectives: "poor UX", "better privacy", "high accuracy". Adjectives are cheap. This article uses numbers — prices read off the vendors' own pages, and page weight measured in a browser on the day of writing.

Two of those numbers are inconvenient for us. They are in here anyway, in their own section, because a comparison whose author wins every row is not worth reading.

The comparison in numbers

Details taken from the vendors' official pages, retrieved on 4 October 2026 (reCAPTCHA: docs.cloud.google.com/recaptcha/docs/compare-tiers; hCaptcha: hcaptcha.com/pricing; Turnstile: developers.cloudflare.com/turnstile/plans/); they change, so check the date before you rely on them.

Google reCAPTCHA is free up to 10,000 assessments a month in its Essentials tier; you have to add a payment method. In the Premium tier, 10,001 to 100,000 assessments cost a flat $8, then $1 per 1,000; Enterprise sits above that. hCaptcha keeps a free Basic tier; Pro is $99 a month billed annually or $139 monthly, and Enterprise is on request. Passive mode without a visible task is only available in Pro and Enterprise. Cloudflare Turnstile is free with unlimited verifications — the free tier restricts features, not traffic: up to 20 widgets, 10 hostnames per widget, seven days of analytics. It does not require a Cloudflare proxy in front of your site. SilentShield's free tier covers 500 requests a month on one domain; Basic is €9 a month for 5,000 requests, Pro €29 for 25,000 requests across five domains.

What each one actually loads into your page

Price is only half the cost. The other half arrives in your visitor's browser, and it is rarely published. So we measured it: Chromium, a cold profile, each vendor's own demo page, and the transferred size of every request going to that vendor — compressed, as it travels. Measured on 4 September 2026.

The spread is larger than any vendor page suggests. reCAPTCHA's api.js is a 1 KB bootstrapper; the file it pulls in, recaptcha__en.js, is 345 KB compressed on its own. The invisible v3 variant loads the same core script — measuring its demo page gave 459 KB, so "invisible" does not mean "light". hCaptcha's demo transferred 742 KB, most of it two asset bundles from newassets.hcaptcha.com.

Read this honestly: Turnstile is the lightest of the four, and it is not close to us. We are second, at 48.9 KB — 45.0 KB for the behaviour module plus a 3.9 KB loader (re-measured 23 September 2026). Against reCAPTCHA and hCaptcha the gap runs the other way, by a factor of roughly nine and fifteen.

Google reCAPTCHA: the legacy giant

reCAPTCHA does two things well: detection backed by Google-scale data, and an adoption so wide that nobody has to explain it to a client. The experience is where it falls apart. Image challenges are friction, the mobile experience is painful, and users drop off before they finish the form.

Then there is the data path. reCAPTCHA loads Google scripts into your page and sends the result to Google infrastructure. Since 2 April 2026, Google acts as a processor for it according to its own FAQ (docs.cloud.google.com/recaptcha/docs/faq). Whether you may load it without consent is still a matter for legal assessment, and in practice it is often debated. The model has aged too: it leans on challenge-response logic while bots increasingly solve those challenges with the same machine learning that is supposed to catch them.

Bottom line: the widest adoption, a 423 KB payload, and a data path to Google that needs a legal assessment.

hCaptcha: privacy-focused, with a catch

hCaptcha loads no Google script and offers a free Basic tier. There, the UX is the same as reCAPTCHA's: the same image grids, the same frustration, the same drop-offs. Passive mode without a visible task is only available in Pro and Enterprise (hcaptcha.com/pricing).

It also turned out to be the heaviest of the four in our measurement, at 742 KB.

Bottom line: no Google script, but a visible check remains in the free tier.

Cloudflare Turnstile: the best of the old world

Turnstile is the one that genuinely improved. It asks for no images or text to decipher — in Managed mode it shows a checkbox when it sees risk — takes a privacy-friendly approach, and at 27.5 KB it is the lightest thing in this comparison by a clear margin. If the decision is "which CAPTCHA", the answer is Turnstile, and this article is not going to pretend otherwise.

Two things you should know. When in doubt it asks the visitor — detect, doubt, ask — so on a bad day a real customer is briefly held up; the same is true for us, except that we show a short arithmetic task. And Cloudflare is a US company — not the same as a provider based in the EU.

Bottom line: the best CAPTCHA — and still a CAPTCHA.

The core problem: challenge-based systems are outdated

All three share the same DNA: detect — doubt — challenge the user. That model made sense in 2010. In 2026, bots solve image challenges with AI, humans abandon forms when they are questioned, and privacy law asks for less tracking, not more.

The risk is the worst of both worlds: the automated traffic that matters gets through, and some share of your real customers does not.

What modern bot protection looks like

The next generation does not ask the visitor anything in the normal case. It watches how the form is actually filled in — timing, movement, the rhythm of typing — scores that in the background, and returns a verdict when the form is submitted. By default: no puzzle, no cookie, no interruption.

That is what SilentShield does — by default, not in every case: when the result is unclear, it shows a short arithmetic task. That is why the "visible task" column above says "none by default" rather than "none".

Installing it: the actual code

One script tag in your page, one call on your server. Nothing else changes.

The widget goes into the page that carries the form:

<script src="https://api.silentshield.io/client.js?k=YOUR_API_KEY" crossorigin="anonymous" defer></script>

It initialises itself, pulls its configuration (theme, language, badge) from your dashboard, and writes a field called behavior_nonce into your form. Your server then verifies that field on submit. In PHP:

use SilentShield\Client;

$client = new Client(getenv('SILENTSHIELD_API_KEY'));

if (!$client->verify($_POST['behavior_nonce'] ?? '')) {
    http_response_code(403);
    exit('Verification failed.');
}
// Human — process the submission.

In Node:

const { human } = await shield.verify(req.body.behavior_nonce);
if (!human) return res.status(403).send("Verification failed");

One detail is worth more than the rest of this section: false does not always mean "bot". Verification is fail-secure, so it also returns false when we could not answer at all — including when your monthly quota is used up. Both SDKs tell you which case you are in (lastFailure() in PHP, reason in Node). If it is the quota, fall back to your own checks rather than turning away every real visitor until the first of next month. Vendors rarely write that down; it is the failure mode that actually bites.

There are SDKs for PHP, Node, Go and edge runtimes, plus a WordPress plugin that does both steps for you.

Migrating from reCAPTCHA: what changes, what stays

The move is smaller than it looks, because a CAPTCHA touches exactly three places in your code.

What is replaced: the <script> tag in your page, the server-side call to siteverify, and the field name — g-recaptcha-response becomes behavior_nonce. What stays: your form, your own validation, your honeypot, your rate limits. Bot protection is a layer, not a replacement for the checks you already have.

Do it in this order. Add the new script while reCAPTCHA is still running and compare verdicts for a few days; you will see your own traffic instead of trusting a table. Then move the server-side check over. Then remove the reCAPTCHA script and the Google entry from your privacy policy and your record of processing activities — that last step is the one teams forget, and it is the one an authority looks at.

Where SilentShield is the weaker choice

Three rows where we lose, stated plainly.

Our script is bigger than Turnstile's. 48.9 KB against 27.5 KB — we load asynchronously after render and block nothing a visitor is waiting for, but if every kilobyte on your page is contested, that is a real argument against us.

We are not free at volume. Turnstile costs nothing at any size. Our free tier ends at 500 requests a month. If price is your only criterion, we are not the answer.

We are younger. reCAPTCHA has been running for over a decade and has seen attack patterns we have not. That is not a small thing, and no positioning changes it.

What €9 buys instead is a different trade: no Google script loads, no cookie is set, the visitor sees no task by default — only a short arithmetic task when the result is unclear — and with the EU endpoint, verification runs directly on our servers in Germany, without a CDN. If that is worth more to you than free, we are the better choice. If it is not, take Turnstile — that is a defensible decision, and this article will not pretend otherwise.

What this means for your business

Every extra step in a form costs revenue, and a challenge is the most expensive step you can add: it arrives at the exact moment someone has decided to contact you. Abandoned forms, dropped checkouts, lost leads, and a mobile experience that is worse than the desktop one you tested — even Turnstile, the best of the three, does not remove that risk entirely, because it can still decide to ask — and we ask too when the result is unclear, with a short arithmetic task.

The question is not which CAPTCHA annoys your customers least. It is how rarely your customers need to be questioned at all.

The verdict

• reCAPTCHA — widest adoption, 423 KB, data to Google. For an EU site a case for legal assessment, often including a discussion about consent.
• hCaptcha — no Google script, heaviest of the four at 742 KB, the same puzzle for the visitor in the free tier (passive only in Pro/Enterprise).
• Turnstile — the best CAPTCHA: free, 27.5 KB, mostly quiet. Still a US company, and still a CAPTCHA underneath.
• SilentShield — no task by default (a short arithmetic task when the result is unclear), no cookie, data held on servers in Germany, 48.9 KB. €9 a month once you pass 500 requests.

All four ask the visitor when in doubt; the difference is how often, and with what.

Try SilentShield — bot protection that stays invisible by default