hCaptcha vs reCAPTCHA: Privacy, Pricing, and Accuracy

Quick verdict table

Pricing and quota terms shift; treat the pricing row as directional as of mid-2026 and confirm current terms on each vendor's site before you build a billing assumption around it.

How each one works

hCaptchapresents an image-selection challenge (or runs invisibly in Enterprise's frictionless mode) and returns a pass/fail token you verify server-side. It was built as a privacy-respecting, revenue-generating alternative to reCAPTCHA — sites that embed it can opt into a small payment for the human-labeling work their visitors do, though most contact-form use never touches that program.

reCAPTCHAcomes in two flavors that behave very differently. reCAPTCHA v2 is the classic "I'm not a robot" checkbox, sometimes followed by an image grid. reCAPTCHA v3 skips the challenge entirely and instead watches mouse movement, click cadence, and cross-site Google cookies in the background, returning a 0.0–1.0 risk score that you threshold yourself.

The practical difference: hCaptcha's free tier leans on a visible challenge more often, while reCAPTCHA v3 is invisible by default but ties the assessment to Google's much larger cross-site signal graph — which is exactly what raises the privacy question in the next section.

Bot-stopping accuracy and solve rates

Both vendors block the overwhelming majority of generic, scraper-driven spam — the low-effort bots that fill every field they find and submit in under a second. Where they diverge is the sophisticated tail: reCAPTCHA v3's score is built on a much larger behavioral dataset across the wider web, which tends to give it a slight edge against targeted or human-assisted attacks. hCaptcha's classic challenge mode is comparably effective against scrapers but asks more of the visitor to get there.

Neither number matters much for a typical contact form, where 80–90% of spam volume is the cheap, unsophisticated kind that a honeypot and a time-to-submit floor already catch for free — see honeypot vs reCAPTCHAfor measured numbers on that split. Reach for either vendor's behavioral scoring only once you've confirmed the server-side layers aren't enough.

Privacy and GDPR

This is the section that usually decides the vendor choice. reCAPTCHA sets cookies that Google can associate with a visitor's broader Google identity and processes assessment data in the US, which — after the CJEU's Schrems II ruling invalidated the original EU-US Privacy Shield — puts EU sites in the position of needing either explicit consent or a valid transfer mechanism (Google now offers EU data processing terms, but the underlying data-flow concern is why many EU-facing teams avoid reCAPTCHA by default).

hCaptcha was built to sidestep exactly this problem: it doesn't link assessments to a Google account or ad profile, and its privacy posture is generally treated as friendlier for GDPR consent flows. That doesn't make it consent-free — it's still a third-party script processing visitor data, so document it in your privacy policy and cookie disclosure either way. Neither vendor eliminates the consent conversation; hCaptcha just starts from a smaller data-sharing footprint.

Pricing and free-tier limits

Both hCaptcha and reCAPTCHA offer a free tier that covers the volume a typical contact form will ever see. hCaptcha's Enterprise plan adds invisible mode, the accessibility cookie, and custom branding removal for teams that need them. reCAPTCHA's free assessment quota has shifted over time, and Google pushes high-volume or fraud-focused use toward reCAPTCHA Enterprise, which is priced per assessment.

Vendor pricing and quotas change; the numbers above are accurate as of mid-2026 to the best of public documentation — confirm current terms directly with each vendor before you commit a budget line to either one. For a form doing a few hundred submissions a month, cost is rarely the deciding factor between the two; privacy posture and friction usually are.

Accessibility comparison

hCaptcha Enterprise is WCAG 2.1 AA certified and offers an accessibility cookie that lets verified users bypass the challenge entirely — a meaningful advantage for regulated or public-sector sites. reCAPTCHA v2's audio fallback has long-documented transcription failures for users with hearing impairments, and its image challenges defeat low-vision users outright. reCAPTCHA v3 removes the visible challenge but introduces a different problem: its behavioral fingerprinting can flag users with motor impairments — slower mouse movement, atypical click timing — as bots, silently rejecting them with no recourse.

If your form serves a general public audience under an accessibility mandate, that combination tips the scale toward hCaptcha Enterprise or away from a visible CAPTCHA altogether in favor of server-side detection that never asks the visitor to prove anything.

Self-hosting and data residency

Neither hCaptcha nor reCAPTCHA can be self-hosted — both are hosted verification services your form calls out to, and both process the assessment on the vendor's infrastructure regardless of where your own servers sit. If a hard data-residency requirement rules out sending visitor data to a third-party US-based service at all, your realistic options are a proof-of-work CAPTCHA like Friendly Captcha (still third-party, but cookie-free and EU-hosted) or dropping the CAPTCHA layer entirely in favor of spam detection that runs entirely on your own server.

Migrating from reCAPTCHA to hCaptcha

hCaptcha was deliberately designed as a near drop-in replacement for reCAPTCHA — the widget markup and server-side verification call are structurally similar, so most migrations are a script-tag swap plus a secret-key change rather than a rebuild.

<!-- Before: reCAPTCHA v2 -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input name="email" type="email" required />
  <div class="g-recaptcha" data-sitekey="YOUR_RECAPTCHA_SITEKEY"></div>
  <button type="submit">Send</button>
</form>

<!-- After: hCaptcha -->
<script src="https://js.hcaptcha.com/1/api.js" async defer></script>
<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input name="email" type="email" required />
  <div class="h-captcha" data-sitekey="YOUR_HCAPTCHA_SITEKEY"></div>
  <button type="submit">Send</button>
</form>

The server-side change is just as small: instead of posting the g-recaptcha-response field to Google's siteverify endpoint, you post h-captcha-responseto hCaptcha's. If you're handling verification yourself rather than through a form backend that does it for you, budget an hour to update the endpoint URL, the field name, and your secret key.

When to use neither

Here's the honest take: for most contact forms, you need neither hCaptcha nor reCAPTCHA. A server-side spam stack — honeypot field, time-trap on submissions that arrive suspiciously fast, and IP-based rate limiting — blocks the large majority of contact-form spam without asking a single visitor to prove they're human. That's the same finding covered in more depth in honeypot vs reCAPTCHA: honeypots alone catch 85%+ of generic bot traffic, and layering in a time floor and rate limiting closes most of the rest.

splitforms runs exactly that server-side stack by default on every form — no widget, no third-party script, no consent-banner conversation. If you still want a visible CAPTCHA on top (for a high-value form, or because a stakeholder wants the reassurance of a checkbox), optional reCAPTCHA v2 remains available as a drop-in addition; splitforms reads the g-recaptcha-responsefield automatically and verifies it server-side. The point isn't that CAPTCHAs are bad — it's that they're a second line of defense you should add after measuring real spam, not a default you reach for on day one.

For the fuller vendor roundup that includes Cloudflare Turnstile and Friendly Captcha alongside both tools here, see best CAPTCHA for contact forms. And if you want the no-CAPTCHA setup as a starting point, the spam-free contact form guide walks through it directly.

Next steps and where to get help

• Weighing more than two vendors? See the full roundup at best CAPTCHA for contact forms, which also covers Cloudflare Turnstile and Friendly Captcha.
• Curious whether you need a CAPTCHA at all? Honeypot vs reCAPTCHA has the measured spam-block numbers behind the "neither" recommendation above.
• Want the no-CAPTCHA setup? Start with spam-free contact form or explore reCAPTCHA alternatives if you specifically want off Google's stack.
• See everything splitforms ships server-side by default on the spam-protection feature page — included free on every plan; see pricing.

FAQ