hCaptcha

What is hCaptcha?

hCaptcha is a bot-detection and fraud-prevention service that websites and apps embed at the points where abuse happens: signup forms, login pages, checkout flows and APIs. If you have ever clicked squares containing buses, you have met the consumer-facing end of it — but that widget is the smallest part of the product. hCaptcha now presents itself as an enterprise-grade platform for real-time bot detection, AI agent verification and fraud prevention, evaluating behaviour continuously across a session rather than gating a single moment with a puzzle.

The company behind it matters to the story. hCaptcha is a service of Intuition Machines, Inc., which holds the trademark, and its advisor list includes Brave CEO and JavaScript creator Brendan Eich alongside UC Berkeley professor Dawn Song. That lineage explains the positioning: the pitch is explicitly aimed at Google's reCAPTCHA, and the differentiator is that hCaptcha is not owned by an advertising business. Its architecture is marketed as Zero-PII, and the claim is that detection can work without the browser fingerprinting that ad-adjacent security products rely on. Rather than relying on browser fingerprinting or personal data, it continuously assesses whether activity reflects legitimate user intent, using what the company calls Advanced Threat Signatures plus behavioural analysis and risk scoring drawn from thousands of signals.

It is worth knowing where the product came from, because the origin still shows. The About page's own description still calls it a drop-in replacement for reCAPTCHA that earns website owners money and helps companies get their data labeled — a two-sided marketplace where publishers were paid for the human labour of solving challenges, and that labour produced training data. The enterprise security platform grew out of that machine, and both halves still exist in the documentation.

This is infrastructure, not an app. Nobody signs up to use hCaptcha the way they sign up for a writing assistant; a developer integrates it, a security team tunes it, and millions of end users encounter it without ever choosing it.

Core Features

• Behavioural bot detection with risk scoring: The engine evaluates each interaction against thousands of signals and returns a judgement about intent rather than a simple pass/fail on a puzzle. Enterprise deployments get numeric risk scores they can act on with their own logic, plus APT mitigation aimed at persistent, adaptive attackers rather than volume bots.
• Drop-in reCAPTCHA compatibility: Migration is deliberately cheap. hCaptcha methods are API-compatible with reCAPTCHA methods, for example render() and onload(), and custom data attributes like theme, size and tab-index behave the same way, so an existing integration usually needs a script URL and a key swap rather than a rewrite.
• Passive and invisible modes: Beyond the visible checkbox, the platform offers a low-friction 99.9% passive mode and, at the enterprise tier, a fully passive No-CAPTCHA mode intended to challenge less than 0.1% of legitimate users. The puzzle becomes the exception rather than the default.
• Fraud and account-security modules: The platform extends past bot blocking into account takeover detection, multi-accounting, account sharing, synthetic identities, incentive abuse and transaction fraud, plus a pull-based SMS MFA designed to remove the toll-fraud incentive that push-based SMS creates.
• Private Learning and custom threat models: Rather than a single global model, enterprise customers can get risk models adapted to their own traffic, with real-time adaptive learning as attack patterns shift, and scoped, blinded signal enrichment they can feed into their own ML.
• Operational breadth for awkward environments: Compatibility all the way back to Internet Explorer 8, support for non-JavaScript clients, and first-party hosting so requests go to hcaptcha.yourdomain.com — features that exist because large deployments always have edge cases, plus a stated ability to work in every country, unlike reCAPTCHA.
• Accessibility accommodation paths: A text-based accessibility challenge that sites can enable, and a universal accessibility authorisation that registered users carry via an encrypted cookie, are offered as alternatives to visual challenges.

Use Cases

1. Protecting signup from fake account creation: Mass registration is the entry point for most downstream abuse — spam, review manipulation, promo farming. Placing verification at signup and reading the risk score lets a platform block obvious automation outright while routing borderline attempts to additional checks, instead of discovering the problem weeks later in moderation queues.
2. Defending login against credential stuffing: Attackers replay leaked username and password pairs at volume. Because the platform evaluates behaviour continuously rather than only at a single gate, and clusters attackers across many IPs and devices, it targets the pattern of an attack rather than any single request — which is what makes blocking possible without punishing customers who share an office IP.
3. Stopping payment and checkout fraud: Card testing, chargeback fraud and fraudulent transactions cost real money per event, so this is where the enterprise tier earns its price. The vendor states that a majority of major payment platforms use its enterprise offering, and its fraud modules are pitched at stopping transaction abuse with no PII required.
4. Guarding promotions and in-game economies: Giveaways, referral bonuses and in-game rewards attract multi-accounting and incentive abuse, where the attacker is often a real human operating at scale rather than a bot. Detecting human abuse — not just automation — is the harder half of this problem and an explicit product goal.
5. Serving privacy-sensitive and blocked-region audiences: For VPN providers, private messaging services, and any site with users on Tor or Brave, a security layer that blocks privacy-conscious users is a business problem. The stated ability to work in every country matters for the same reason it mattered to Cloudflare in 2020: Google services are not universally reachable.
6. Meeting compliance requirements in regulated sectors: For healthcare, finance and government deployments, the ISO 27001, SOC 2 Type II and PCI DSS certifications, DPA with standard contractual clauses, and minimised data collection are procurement prerequisites rather than marketing points.

How to use hCaptcha

1. Create an account and generate a sitekey. Decide the granularity first: you can use one sitekey across many sites, or one per flow — for example one for signup and one for login — because behaviour and statistics are tracked per sitekey.
2. Add the client script and container to your page. Load the hCaptcha JavaScript and place an empty element carrying the h-captcha class and your data-sitekey, typically inside the form you want to protect. Teams arriving from Google's product usually rely on drop-in reCAPTCHA compatibility here and keep their existing markup almost untouched.
3. Verify server-side, always. When a challenge passes, the browser receives a token that travels with your form as h-captcha-response, and your server confirms it against api.hcaptcha.com/siteverify before trusting the request. Client-side success alone proves nothing.
4. Update your Content Security Policy. Add the hCaptcha domains to script-src, frame-src, style-src and connect-src. Critically, do not hard-code specific subdomains, like newassets.hcaptcha.com, into your CSP: asset subdomains used may vary over time or by region.
5. Tune friction to your risk. Start with the visible widget, then move toward passive or invisible modes as you gain confidence, using the explicit render mode with callback, error-callback and expired-callback so your application handles token expiry gracefully rather than failing at submit time.
6. Configure accessibility before launch, not after. Decide whether to enable the text-based accessibility challenge, and document an alternative accommodation path for users your chosen configuration might exclude.

Tips & Best Practices

• Never treat the client-side callback as authorisation. The only meaningful verification is the server-side siteverify call. Any check that lives entirely in the browser can be removed by whoever controls the browser — which, by definition, is the attacker you are defending against.
• Use separate sitekeys for separate flows. Signup and login attract different attack patterns and warrant different difficulty settings. Splitting the keys also gives you per-flow statistics, which is what turns "we're seeing more bots" into an actionable observation.
• Budget your evaluation volume before you deploy widely. The paid tier meters evaluations, so a verification placed on a high-traffic page that does not actually need protection is a recurring cost with no security benefit. Protect the endpoints where abuse has consequences.
• Plan the accessibility path deliberately. The vendor is explicit that responsibility sits with you: websites and apps that use hCaptcha decide which accessibility features to enable, and whether to use them or provide alternate accommodations. Do not assume the default configuration satisfies your legal obligations.
• Watch for the ad-blocker interaction. The accessibility cookie mechanism depends on cross-site cookies for hcaptcha.com, so users running strict blockers may keep receiving challenges. If your audience skews privacy-conscious, test with those blockers enabled rather than in a clean browser.
• Measure friction against fraud, not in isolation. Every point of verification loses some legitimate users. The correct comparison is abandoned signups versus prevented abuse, and that ratio differs completely between a bank's login page and a newsletter form.

Who is hCaptcha for?

• Web and application developers: The people who actually integrate it, add the script, wire up server-side verification and fix the CSP when assets are blocked.
• Security and trust-and-safety teams: Groups responsible for account takeover, fake accounts and platform abuse, who need risk signals rather than just a blocked-request counter.
• Fraud and payments teams: Functions measuring success in chargebacks avoided and card testing stopped, for whom bot blocking is only the first layer.
• Platforms in regulated industries: Healthcare, finance and government services where certification status and minimised data collection determine whether a vendor can be used at all.
• Companies with globally distributed users: Especially those serving regions where Google services are unreliable, where a US-default security layer silently locks out real customers.
• Privacy-oriented services: VPN, private email and messaging providers whose users would reject a tracking-based security layer on principle.
• Site owners migrating off reCAPTCHA: Teams pushed by cost, regional availability or a desire to keep user data away from an advertising company.

Platforms

• Web integration: The primary delivery mechanism — a JavaScript widget plus a server-side verification endpoint, working across any web stack.
• Framework plugins: Official plugins and examples for ReactJS, VueJS, Angular, Node and Express, plus WordPress and hundreds of other platform integrations.
• Mobile SDKs: Native iOS and Android SDKs for a consistent experience across web, mobile web and native applications.
• Server-side and API protection: The platform can run entirely server-side for API endpoints, not only in browser-rendered forms.
• Legacy and constrained environments: Support extending back to Internet Explorer 8 and to clients without JavaScript, which matters for deployments with genuinely long tails.
• First-party hosting: Enterprise customers can route requests and assets through their own domain, useful for CSP strictness, telecom zero-rating and avoiding third-party blocking.

Pricing & Plans

There is a genuinely free tier. hCaptcha offers a free Basic tier, a Pro tier that bundles a monthly evaluation allowance and then charges per thousand evaluations beyond it, and an Enterprise tier sold through sales. The free plan is not a trial: it includes the core bot protection, global availability and the compliance posture, which is why the service is common on small sites and open-source projects.

The tier boundaries are worth studying before committing, because the capabilities most people assume are core are not. Risk scores, the fully passive No-CAPTCHA mode, APT mitigation, enterprise SLAs, SAML SSO and the reporting APIs are all Enterprise-only, while the low-friction passive mode, custom themes and analytics sit at Pro. If your plan depends on reading a numeric risk score in your own logic, you are buying Enterprise regardless of your traffic volume. Pro is offered with a time-limited free trial that requires no payment details and reverts to the free plan automatically. Note also that the headline competitive claim about accuracy and cost carries a footnote: cost and accuracy estimates are based on customer-reported comparison data — that is, customer self-reporting rather than independent benchmarking. Confirm current figures on the official pricing page.

Alternatives

• Google reCAPTCHA: The incumbent by an enormous margin and the product hCaptcha positions against directly; the trade-off is data flowing to an advertising company and uneven availability in some regions.
• Cloudflare Turnstile: Free to any site, built explicitly to avoid visual puzzles, and notable here because Cloudflare built it after using hCaptcha.
• Friendly Captcha: A proof-of-work-based approach positioned around EU data protection, aimed at teams that want no user interaction at all.
• Arkose Labs: Enterprise-focused fraud and abuse prevention with an emphasis on attacker economics rather than one-time verification.
• Server-side rate limiting and WAF rules: Not a like-for-like replacement, but for many low-stakes forms, throttling plus a honeypot field solves the actual problem without adding a third-party dependency to every page load.

Limitations & Considerations

• The privacy story deserves a careful read, not just the headline. The Zero-PII framing is real in the sense that hCaptcha is not an advertising business, and its independence from Google was precisely why Cloudflare adopted it. But the privacy policy is explicit that the service collects mouse movements, scroll position, keypress events, touch events, and similar information as applicable in order to judge whether a visitor is human. Behavioural telemetry is the mechanism; the claim is that it is not linked to an identified person, not that nothing is collected.
• Your users' answers are training data. Under the privacy policy, answers end users give to prompts are classified as Labeled Data and used for labeling data for use in machine learning applications. The policy states this data is not tied to an identified individual, but site operators should understand that asking a visitor to solve a challenge may also be asking them to perform unpaid labelling work — the business model the About page still describes.
• Legal responsibility for end users sits with you, not the vendor. The privacy policy states plainly that the processing of End-User personal data is governed by the agreement we have with our Integrator customers, not this Privacy Policy. If a regulator asks why your visitors' data went to a third party, the answer has to come from your DPA and your privacy notice.
• Accessibility cannot be fully solved, by the vendor's own admission. The accessibility statement concedes that some features like visual challenges cannot be fully accessible while fulfilling security functions. The accommodation path also has friction: the encrypted accessibility cookie can be used several times per day but must be refreshed periodically via login, and aggressive ad blockers or cross-site cookie blocking break it — which puts privacy-conscious disabled users in an awkward position.
• Independent effectiveness data has never been easy to obtain. When The Register asked for data comparing how hCaptcha and reCAPTCHA fare against automated attacks, the vendor expressed reluctance to release it. That was 2020, and public head-to-head benchmarks remain scarce; the vendor's own accuracy and attack-reduction figures are customer-reported.
• The whole CAPTCHA category is under pressure, and its most famous customer left. TechCrunch reported that Cloudflare at one point moved to a service called hCaptcha — to mixed reviews, citing a challenge that asked users to name a vegetable preference and click 27 train images, and Cloudflare subsequently built Turnstile and cut its own CAPTCHA usage by 91%. The same reporting notes human- and AI-backed CAPTCHA-solving services for as low as $0.50 per thousand solved CAPTCHAs. Verification puzzles are a decaying defence, which is why the vendor's own roadmap has moved toward passive detection.
• Market position needs the qualifier. hCaptcha describes itself as the largest independent service of its kind, and that word is load-bearing: by one measure 97.7% of the top million websites by traffic use Google's reCAPTCHA. Independence is the differentiator; scale leadership is not.

FAQ

Q1. Is hCaptcha free?

Yes, there is a permanent free tier that includes core bot protection, global availability and the stated compliance posture — not merely a trial. Paid tiers add passive modes, analytics, risk scores and enterprise controls, with usage metered by evaluation volume.

Q2. How hard is it to switch from reCAPTCHA?

Deliberately easy. The methods are API-compatible with reCAPTCHA equivalents such as render() and onload(), and attributes like theme, size and tab-index work the same way, so most existing integrations need a script swap and a new key rather than a rewrite.

Q3. Does hCaptcha actually collect no data?

That is not quite the claim. The Zero-PII architecture is about minimising personal information, but the privacy policy discloses collection of behavioural signals such as mouse movements, scroll position and keypress events to determine whether a visitor is human. The stated position is that this is not tied to an identified individual.

Q4. Are the answers my visitors give used to train AI?

The privacy policy classifies responses to prompts as Labeled Data, used for labeling data for machine learning applications, and states it is not tied to any identified individual. This reflects the product's origins as a data-labelling marketplace alongside its security function.

Q5. Is it GDPR compliant?

The vendor states it supports compliance with GDPR and CCPA and maintains ISO 27001, SOC 2 Type II and PCI DSS certifications, with EU transfers handled under standard contractual clauses in its data processing addendum. Importantly, end-user data processing is governed by your agreement with hCaptcha rather than by its public privacy policy, so your own DPA and privacy notice carry the obligation.

Q6. Is hCaptcha accessible to users with disabilities?

Partly, and the vendor is candid about the boundary. It offers a text-based accessibility challenge and a registered accessibility cookie, targets WCAG 2.2 AA, but states that visual challenges cannot be fully accessible while performing their security function, and that the site operator decides which accommodations to enable.

Q7. Can bots or paid humans just solve it anyway?

To some degree, yes — this is true of the whole category. Independent reporting has documented commercial solving services priced at fractions of a cent per solve and AI-based attacks against widely used CAPTCHAs, which is why the vendor's roadmap emphasises passive behavioural detection over harder puzzles.

Q8. Do I still need server-side verification?

Always. The browser only receives a token; your server must submit it to the verification endpoint before trusting the request. Any check that exists only on the client can be bypassed by the attacker who controls that client.

Q9. Who is behind hCaptcha?

It is a service of Intuition Machines, Inc., which holds the trademark. The company's advisors include Brave CEO and JavaScript creator Brendan Eich and UC Berkeley professor Dawn Song, and its stated specialism is deep learning and large-scale visual-domain machine learning.

Q10. Does it work in every country?

The vendor explicitly markets global availability as a differentiator against reCAPTCHA, which is not reliably reachable everywhere. This was one of Cloudflare's stated reasons for adopting it in 2020, alongside cost and privacy considerations.