Point any HTML form at one endpoint. 500 free submissions — no card, no time limit — and unlimited forms.
Create free accountYes, hCaptcha has a free plan. Basic costs $0, and hCaptcha's plans page puts it at free up to 10,000 requests per month. Pro costs $139 a month, or $99 a month billed yearly, and includes 100,000 evaluations a month plus the low-friction passive mode; Enterprise is priced by sales.
This page covers cost and limits only. For privacy, accessibility and how to swap one widget for another, see hCaptcha vs reCAPTCHA vs Turnstile.
What does the hCaptcha free plan include?
The free tier is called Basic on the pricing page and "Publisher" in the developer FAQ. It includes the core bot protection and works in every country. In practice:
- Price: $0, no card needed.
- Visitor experience: the classic CAPTCHA. hCaptcha's Pro page says that on Free "most users will generally see a challenge".
- Difficulty: four difficulty levels in Publisher (free) accounts, per the FAQ. Passive modes are not listed for free accounts.
- Domains: the FAQ says the number of domains is not restricted.
- Secret key: free users may rotate the secret once per day (developer guide).
Is there an hCaptcha request limit on the free plan?
hCaptcha's own pages disagree. The plans page says "Free up to 10,000 requests per month". The pricing page lists no cap for Basic at all. hCaptcha doesn't publish what happens when a free account goes over 10,000, and neither page mentions rate limits. Treat 10,000 requests a month as the working limit, and ask hCaptcha before you plan for more on Basic.
How much do hCaptcha Pro and Enterprise cost?
Pro: $139/month, or $99/month billed yearly
Pro includes 100,000 evaluations a month. Extra evaluations cost $0.99 per 1,000, charged periodically after the included quota is used (Pro page, FAQ). On top of Basic it adds:
- 99.9% Passive mode: hCaptcha says fewer than 0.1% of legitimate users get a challenge in this mode (Pro page).
- Risk-based difficulty: challenges get harder as risk rises, from no CAPTCHA to visual tasks.
- Custom themes and analytics, both listed as Pro features on the pricing page.
The pricing page offers a 14-day trial with no payment required, after which you move to Free unless you keep Pro. If a Pro payment fails, hCaptcha tries to collect up to three times, then downgrades the account to the free version (FAQ).
Enterprise: price not published
The pricing page says "Talk to Sales", with no list price and no published request limit. Enterprise adds risk scores, a fully passive no-CAPTCHA mode, APT mitigation features, enterprise SLAs, a multi-user dashboard with SAML SSO, and advanced analytics with reporting APIs. hCaptcha also claims Enterprise is up to 50% more cost-effective than reCAPTCHA; its footnote says that estimate is based on customer-reported comparison data (pricing page).
hCaptcha vs reCAPTCHA vs Turnstile: what each costs
Read the table by volume. Under 10,000 checks a month, all three cost nothing. Between 10,000 and 100,000, reCAPTCHA's $8 flat fee is far below hCaptcha Pro, and Turnstile is still free. hCaptcha's paid plans are priced for what they add (passive mode, analytics, risk scores), not for volume alone.
What changed with reCAPTCHA billing on Google Cloud?
reCAPTCHA now runs on Google Cloud projects, and the free allowance is counted per organization. According to Google's migration overview, new Classic keys stopped in Q3 2024, automated migration of Classic keys began in Q4 2025, and by Q1 2026 migration was complete and API access was locked for keys without a Google Cloud project. Existing v2 and v3 site keys keep working after migration, with no code changes.
The cost details that matter for a form, from the billing docs:
- 10,000 free assessments per calendar month, aggregated across every account and site in the organization. An agency running many client forms shares one allowance.
- Without billing (Essentials), requests fail with a 429 quota error once the organization passes 10,000; the quota resets on the 1st of the next month.
- With billing (Premium), requests keep working and are billed: an $8 flat fee for 10,001 to 100,000, then $1 per 1,000.
- Over quota, Google says SiteVerify requests fail open (they return success with a 0.9 score), while CreateAssessment requests fail closed with a 429 (migration overview). So a form that only calls SiteVerify stops filtering anything once the quota runs out.
One inconsistency to watch: the billing page says Essentials applies to projects without billing enabled, but the tier comparison lists "a valid billing instrument" as an Essentials requirement. Check what your own Google Cloud console asks for.
Is Cloudflare Turnstile really free?
Yes. The Turnstile plans page lists unlimited challenges on Free, with up to 20 widgets, 10 hostnames per widget and 7 days of analytics. Enterprise (contact sales) adds unlimited widgets, up to 200 hostnames per widget, 30-day analytics, ephemeral IDs and the option to remove Cloudflare branding. For a single site, the free plan's limits are about widgets and hostnames, not traffic. Setup is one script tag and one server call: see Cloudflare Turnstile on an HTML form.
Does a small-site contact form even need a CAPTCHA?
Often not. A contact form on a small site rarely comes near 10,000 checks a month, so cost isn't the issue; friction is. Every CAPTCHA adds a third-party script and, on hCaptcha Basic, a challenge most visitors will see. Much form spam comes from simple scripts that fill every field and post at once, and free server-side checks catch those without asking a person to do anything:
- A hidden honeypot field that people never fill in (splitforms checks
botcheck). Generate one with the honeypot field generator. - A time-trap that drops forms sent less than 2 seconds after the page loaded.
- Per-IP rate limits and rule-based content scoring, with a spam folder you can review.
Honeypot vs reCAPTCHA covers when each layer is enough. If spam still gets through, add a free CAPTCHA rather than a paid one; reCAPTCHA alternatives compares the options beyond these three.
FAQ
Is hCaptcha free?
Yes. hCaptcha's Basic plan costs $0. It gives the classic CAPTCHA experience, where most visitors see a checkbox and often a challenge. The low-friction 99.9% Passive mode, custom themes and analytics are Pro features, and Pro costs $139 a month (or $99 a month billed yearly).
What is the hCaptcha free limit?
hCaptcha's plans page says the free plan is free up to 10,000 requests per month. Its pricing page lists no cap for Basic, and hCaptcha doesn't publish what happens to a free account above 10,000, so plan around that figure and ask hCaptcha before relying on more.
How much does hCaptcha Pro cost?
$139 a month billed monthly, or $99 a month billed yearly. Both include 100,000 evaluations a month; after that hCaptcha bills $0.99 per 1,000 evaluations. There's a 14-day trial with no payment required, and an account whose payment fails after three attempts is downgraded to the free plan.
How much does hCaptcha Enterprise cost?
hCaptcha doesn't publish an Enterprise price; the pricing page says to talk to sales. Enterprise adds risk scores, a fully passive no-CAPTCHA mode, APT mitigation, enterprise SLAs, a multi-user dashboard with SAML SSO, and reporting APIs.
Is hCaptcha cheaper than reCAPTCHA or Turnstile?
Not on the free tiers. Turnstile is free with unlimited challenges, and reCAPTCHA and hCaptcha are both free up to 10,000 a month. Past that, reCAPTCHA charges a flat $8 for 10,001 to 100,000 assessments, while hCaptcha's first paid step is Pro at $99 to $139 a month. hCaptcha's paid tiers buy features (passive mode, analytics), not just volume.
Does a small-site contact form need a paid CAPTCHA?
Usually not. A contact form rarely gets near 10,000 checks a month, so every free tier covers it, and a hidden honeypot field, a time-trap and server-side filtering stop much automated spam without any widget. Add a free CAPTCHA once you've measured spam getting past those checks.
Sources
All prices and limits checked on October 10, 2026. Vendors change plans; the linked pages are the current word.
- hCaptcha pricing:
https://www.hcaptcha.com/pricing - hCaptcha plans:
https://www.hcaptcha.com/plans - hCaptcha Pro:
https://www.hcaptcha.com/pro - hCaptcha developer FAQ:
https://docs.hcaptcha.com/faq - hCaptcha developer guide:
https://docs.hcaptcha.com/ - reCAPTCHA tier comparison:
https://docs.cloud.google.com/recaptcha/docs/compare-tiers - reCAPTCHA billing information:
https://docs.cloud.google.com/recaptcha/docs/billing-information - reCAPTCHA Classic migration overview:
https://docs.cloud.google.com/recaptcha/docs/migration-overview - Cloudflare Turnstile plans:
https://developers.cloudflare.com/turnstile/plans/
splitforms facts come from our own code: /api/submit verifies reCAPTCHA v2 and Turnstile tokens only.