Turnstile vs reCAPTCHA vs hCaptcha: Full Comparison (2026)

Three tools dominate this decision, and most comparisons of them end in adjectives: "poor UX", "better privacy", "high accuracy". Adjectives are cheap. This article uses numbers — prices read off the vendors' own pages, and page weight measured in a browser on the day of writing.

Two of those numbers are inconvenient for us. They are in here anyway, in their own section, because a comparison whose author wins every row is not worth reading.

The comparison in numbers

Prices checked on the vendors' own pages on 3 September 2026; they change, so check the date before you rely on them.

Google reCAPTCHA is free up to 10,000 assessments a month in its Essentials tier. Above that, Standard is a flat $8 up to 100,000 assessments, and beyond that you move into Enterprise at $0.001 per assessment. hCaptcha keeps a permanently free Basic tier; Pro is $99 a month billed annually or $139 monthly, includes 100,000 assessments and charges $0.99 per additional 1,000. Cloudflare Turnstile is free with no published volume limit — the free tier restricts features, not traffic: up to 20 widgets, 10 hostnames per widget, seven days of analytics, no availability guarantee and no per-endpoint rules. SilentShield's free tier covers 500 requests a month on one domain; Basic is €9 a month for 5,000 requests, Pro €29 for 25,000 requests across five domains.

What each one actually loads into your page

Price is only half the cost. The other half arrives in your visitor's browser, and it is rarely published. So we measured it: Chromium, a cold profile, each vendor's own demo page, and the transferred size of every request going to that vendor — compressed, as it travels. Measured on 4 September 2026.

The spread is larger than any vendor page suggests. reCAPTCHA's api.js is a 1 KB bootstrapper; the file it pulls in, recaptcha__en.js, is 345 KB compressed on its own. The invisible v3 variant loads the same core script — measuring its demo page gave 459 KB, so "invisible" does not mean "light". hCaptcha's demo transferred 742 KB, most of it two asset bundles from newassets.hcaptcha.com.

Read this honestly: Turnstile is the lightest of the four, and it is not close to us. We are second, at roughly 47 KB — 42.6 KB for the behaviour module plus a 3.7 KB loader. Against reCAPTCHA and hCaptcha the gap runs the other way, by a factor of nine and sixteen.

Google reCAPTCHA: the legacy giant

reCAPTCHA does two things well: detection backed by Google-scale data, and an adoption so wide that nobody has to explain it to a client. The experience is where it falls apart. Image challenges are friction, the mobile experience is painful, and users drop off before they finish the form.

Then there is the data path. reCAPTCHA loads Google scripts, tracks behaviour across websites and sends the result to Google infrastructure — which is why several EU supervisory authorities have flagged it, and why it usually needs consent before it loads. For an EU site that alone decides the question. The model has aged too: it leans on challenge-response logic while bots increasingly solve those challenges with the same machine learning that is supposed to catch them.

Bottom line: the widest adoption, the heaviest payload, and the hardest legal position of the four.

hCaptcha: privacy-focused, with a catch

hCaptcha positions itself better on privacy than Google and adds monetisation — you get paid for the challenges your visitors solve. The UX is the same as reCAPTCHA's: the same image grids, the same frustration, the same drop-offs.

The monetisation is the tell. Your visitors effectively become labelling workers, and the incentive behind the product is data generation rather than a fast form. It also turned out to be the heaviest of the four in our measurement, at 742 KB.

Bottom line: it replaces Google's tracking, and keeps the puzzle.

Cloudflare Turnstile: the best of the old world

Turnstile is the one that genuinely improved. It shows a visible challenge far less often, takes a privacy-friendly approach, and at 27.5 KB it is the lightest thing in this comparison by a clear margin. If the decision is "which CAPTCHA", the answer is Turnstile, and this article is not going to pretend otherwise.

Two things it does not solve. It is still challenge-based underneath — detect, doubt, and fall back to asking the visitor — so on a bad day a real customer still gets stopped. And Cloudflare is a US company: better than Google for GDPR purposes, but not the same as processing that never leaves the EU.

Bottom line: the best CAPTCHA — and still a CAPTCHA.

The core problem: challenge-based systems are outdated

All three share the same DNA: detect — doubt — challenge the user. That model made sense in 2010. In 2026, bots solve image challenges with AI, humans abandon forms when they are questioned, and privacy law asks for less tracking, not more.

The result is the worst of both worlds: the automated traffic that matters gets through, and some share of your real customers does not.

What modern bot protection looks like

The next generation does not ask the visitor anything. It watches how the form is actually filled in — timing, movement, the rhythm of typing — scores that in the background, and returns a verdict when the form is submitted. No puzzle, no cookie, no interruption.

That is what SilentShield does, and it is the reason there is no "visible task" column entry for it above: there is nothing for a visitor to see, and nothing for them to fail.

Installing it: the actual code

One script tag in your page, one call on your server. Nothing else changes.

The widget goes into the page that carries the form:

<script src="https://api.silentshield.io/client.js?k=YOUR_API_KEY" crossorigin="anonymous" defer></script>

It initialises itself, pulls its configuration (theme, language, badge) from your dashboard, and writes a field called behavior_nonce into your form. Your server then verifies that field on submit. In PHP:

use SilentShield\Client;

$client = new Client(getenv('SILENTSHIELD_API_KEY'));

if (!$client->verify($_POST['behavior_nonce'] ?? '')) {
    http_response_code(403);
    exit('Verification failed.');
}
// Human — process the submission.

In Node:

const { human } = await shield.verify(req.body.behavior_nonce);
if (!human) return res.status(403).send("Verification failed");

One detail is worth more than the rest of this section: false does not always mean "bot". Verification is fail-secure, so it also returns false when we could not answer at all — including when your monthly quota is used up. Both SDKs tell you which case you are in (lastFailure() in PHP, reason in Node). If it is the quota, fall back to your own checks rather than turning away every real visitor until the first of next month. Vendors rarely write that down; it is the failure mode that actually bites.

There are SDKs for PHP, Node, Go and edge runtimes, plus a WordPress plugin that does both steps for you.

Migrating from reCAPTCHA: what changes, what stays

The move is smaller than it looks, because a CAPTCHA touches exactly three places in your code.

What is replaced: the <script> tag in your page, the server-side call to siteverify, and the field name — g-recaptcha-response becomes behavior_nonce. What stays: your form, your own validation, your honeypot, your rate limits. Bot protection is a layer, not a replacement for the checks you already have.

Do it in this order. Add the new script while reCAPTCHA is still running and compare verdicts for a few days; you will see your own traffic instead of trusting a table. Then move the server-side check over. Then remove the reCAPTCHA script and the Google entry from your privacy policy and your record of processing activities — that last step is the one teams forget, and it is the one an authority looks at.

Where SilentShield is the weaker choice

Three rows where we lose, stated plainly.

Our script is bigger than Turnstile's. 47 KB against 27.5 KB — we load asynchronously after render and block nothing a visitor is waiting for, but if every kilobyte on your page is contested, that is a real argument against us.

We are not free at volume. Turnstile costs nothing at any size. Our free tier ends at 500 requests a month. If price is your only criterion, we are not the answer.

We are younger. reCAPTCHA has been running for over a decade and has seen attack patterns we have not. That is not a small thing, and no positioning changes it.

What €9 buys instead is a different trade: nothing loads from a US vendor, no cookie is set, no visitor has to prove anything, and the assessment stays in the EU. If that is worth more to you than free, we are the better choice. If it is not, take Turnstile — that is a defensible decision, and this article will not pretend otherwise.

What this means for your business

Every extra step in a form costs revenue, and a challenge is the most expensive step you can add: it arrives at the exact moment someone has decided to contact you. Abandoned forms, dropped checkouts, lost leads, and a mobile experience that is worse than the desktop one you tested — even Turnstile, the best of the three, does not remove that risk entirely, because it can still decide to ask.

The question is not which CAPTCHA annoys your customers least. It is whether your customers need to be questioned at all.

The verdict

• reCAPTCHA — widest adoption, 423 KB, data to the USA. Hard to defend for an EU site in 2026.
• hCaptcha — better on privacy than Google, heaviest of the four at 742 KB, same puzzle for the visitor.
• Turnstile — the best CAPTCHA: free, 27.5 KB, mostly quiet. Still a US company, and still a CAPTCHA underneath.
• SilentShield — no task, no cookie, EU processing, 47 KB. €9 a month once you pass 500 requests.

All three CAPTCHAs share one flaw: on the day they are unsure, they hand the problem to your customer.

Try SilentShield — bot protection your visitors never see