reCAPTCHA v2 vs v3: Differences and Which One to Use

Last updated: July 2026. All pricing, limits and statistics in this guide are current as of this date.

TL;DR: reCAPTCHA v2 and v3 fight bots in opposite ways. v2 shows a visible challenge – the “I’m not a robot” checkbox or an image puzzle – and returns a straight pass or fail that Google enforces for you. v3 is invisible: it never shows a challenge and instead returns a risk score from 0.0 (bot) to 1.0 (human), leaving the threshold and the blocking logic to your own code. v2 is simpler and blocks bots out of the box but adds friction; v3 removes friction but shifts the work and the risk of silent false positives onto you. Neither one reads the content of a submission, and both now run through Google Cloud with usage limits. This guide breaks down every difference, tells you which version fits which use case, how to migrate between them, and when to skip CAPTCHA entirely.

reCAPTCHA v2 vs v3 at a glance

	reCAPTCHA v2	reCAPTCHA v3
Released	2014	2018
What the user sees	Checkbox, sometimes an image puzzle	Nothing – fully invisible
How it decides	Pass or fail	A score from 0.0 to 1.0
Who acts on the result	Google blocks failures	Your backend code
User friction	Medium to high	None
Setup effort	Low – a few lines of HTML	Medium – frontend, backend, tuning
Blocks bots by itself	Yes	No, it only scores
Best for	High-risk, low-volume forms	Invisible, continuous scoring

The one sentence to remember: v2 trades user friction for a ready-made decision; v3 trades a ready-made decision for zero friction. Almost every other difference follows from that.

Why the version matters: how reCAPTCHA evolved

The choice is not academic. According to the 2025 Imperva Bad Bot Report, bad bots now make up 37% of all internet traffic, and for the first time in a decade automated traffic has overtaken humans at 51% of the web. AI has made these bots cheaper to run and harder to spot, so the tool guarding your forms matters more than it used to.

reCAPTCHA has been through three generations, and knowing the arc explains why v2 and v3 feel so different:

• reCAPTCHA v1 (2007-2018) showed distorted text you had to retype – the classic squiggly-letters CAPTCHA. It doubled as a way to digitize books. Google shut it down in March 2018.
• reCAPTCHA v2 (2014) introduced the “No CAPTCHA reCAPTCHA” checkbox, replacing most typing with a single click and an occasional image challenge.
• reCAPTCHA v3 (2018) removed the challenge entirely and moved to invisible, score-based risk analysis.

Each generation reduced visible friction. v3 took it to zero – but, as you will see, “no friction” is not the same as “no work” or “no spam.”

What is reCAPTCHA v2?

reCAPTCHA v2 is the challenge-based version – the one most people picture when they hear “CAPTCHA.” It asks the visitor to prove they are human before the form goes through, and it comes in three forms.

The “I’m not a robot” checkbox. The user clicks a box, Google runs a quick background risk analysis – looking at signals like mouse movement on the way to the box, click timing, cookies and browsing history – and either the checkbox turns green or an image challenge appears (“select all squares with traffic lights”). It is the simplest option to add – Google’s docs note it “only requires two lines of HTML to render the checkbox.”

Invisible reCAPTCHA v2. No checkbox. Verification is bound to an existing button or fired by a JavaScript call, and only suspicious visitors get an image challenge. Important: this is not the same as v3 – an invisible v2 can still throw a puzzle at a user it distrusts, while v3 never shows a challenge at all.

reCAPTCHA v2 for Android. A native option for mobile apps, built on Google Play services. Out of scope for website forms, but worth knowing it exists.

The defining trait of v2 is that it makes a binary decision – human or bot – and enforces it for you. The price is friction: every real customer may have to click, and some will have to solve a puzzle. That is exactly where conversions leak.

Pros of reCAPTCHA v2:

• Blocks bots out of the box – no backend logic to write.
• Fast to install: a couple of lines of HTML for the checkbox.
• A visible challenge acts as a clear, hard gate on suspicious traffic.
• Easy to debug, because you can see the result on screen.

Cons of reCAPTCHA v2:

• Adds friction that costs conversions on important forms.
• Image puzzles are an accessibility barrier and are worse on mobile.
• CAPTCHA-solving farms defeat the challenge for a few cents per thousand.
• It judges the visitor, never the content of the submission.

What is reCAPTCHA v3?

reCAPTCHA v3 was built to kill that friction. It never interrupts the visitor and never shows a challenge. Instead it watches how people interact with your pages and returns a score between 0.0 and 1.0:

• Near 1.0 = very likely a real human.
• Near 0.0 = very likely a bot.

You can also tag each event with an action name (login, signup, checkout) so the scores come with context in the admin console. Curious what score you get right now? Run this reCAPTCHA v3 score test in your own browser.

Here is the part that catches people out: reCAPTCHA v3 does not block anyone. It hands you a number and stops. What happens next is entirely your code. The common default threshold is 0.5, and typical responses are:

• Allow the request when the score is high enough.
• Send a borderline submission to moderation.
• Require a second step, such as email confirmation.
• Throttle or flag suspected bots.

So v3 moves the effort from the visitor to the developer. Zero friction for users, but you now own the threshold, the enforcement logic and the ongoing tuning – and tuning is harder than it sounds, since many site owners find v3 almost always returns a 0.9 score no matter who is visiting.

Pros of reCAPTCHA v3:

• Completely invisible – no checkbox, no puzzle, no lost conversions.
• Provides a risk signal on every action, not just one form.
• Lets you tailor the response – allow, moderate, throttle or step up.
• Better mobile experience, since there is nothing to tap.

Cons of reCAPTCHA v3:

• Blocks nothing on its own – you must build the enforcement.
• False positives are silent: real users get blocked with no explanation.
• Scores are hard to interpret and need constant tuning.
• Runs on every page, which widens its data collection and privacy footprint.

reCAPTCHA v2 vs v3: the differences that matter

Beyond “visible vs invisible,” these are the differences that change how you build and maintain your protection.

1. Where the decision is made. v2 decides for you and blocks the failures. v3 only measures – your backend must interpret the score and act. Deploy v3 without that logic and you have added tracking while stopping zero spam.

2. User experience. v2 asks something of every user, from one click to a full puzzle. v3 asks nothing. On checkout, lead capture and signup forms, that gap is real money.

3. Integration effort. The v2 checkbox is nearly copy-paste. v3 needs a script on every scored page, a server-side verification call, a stored threshold and a plan for false positives. Not hard, but real development work.

4. False positives are silent in v3. When v2 wrongly challenges a human, the human sees it and can push through. When v3 scores a real person below your threshold and your code blocks them, they get no puzzle and no explanation – they just fail, often without knowing why. Aggressive thresholds quietly cost you customers.

5. Privacy footprint. v3 runs on every page to gather behavioral signals, which expands the data it collects and raises more GDPR and consent questions than a single v2 checkbox on one form.

6. Keys are not interchangeable. A v2 site key will not work with v3, or vice versa. Switching versions means new keys and a new integration.

Full comparison table

Factor	reCAPTCHA v2	reCAPTCHA v3
Visibility	Visible checkbox or puzzle	Invisible
Output	Pass / fail	Score 0.0-1.0
Enforcement	Handled by Google	Handled by your code
Frontend work	Minimal	Script on every scored page
Backend work	Simple verify call	Verify + threshold + response logic
Friction for users	Low to high	None
Silent false positives	Low – user sees the challenge	Higher – blocking is invisible
Privacy footprint	Smaller	Larger – scores every page view
Analytics	Basic	Per-action scores in the console
Ongoing tuning	Little	Continuous threshold tuning

Which is better for you? reCAPTCHA v2 vs v3 by use case

There is no universal winner. The right version depends on the form and the team behind it. Here is how they line up for common situations.

Your situation	Better fit	Why
Contact or password-reset form, low volume	v2 checkbox	A little friction is fine; you get a block with almost no code
Checkout or lead form where every conversion counts	v3	No visible challenge means no dropped conversions
Login page for a large user base	v3 with a v2 fallback	Invisible for normal users, hard gate for risky ones
No developer time to write scoring logic	v2	Works out of the box; v3 needs backend work
You need risk signals across many pages	v3	Scores every action, not just one gate
Comment sections and community forms	Neither, on its own	The problem is spam content, not just bots (see below)

Choose reCAPTCHA v2 when you want protection that works out of the box, the form is high-risk and low-volume, and a small amount of friction is acceptable.

Choose reCAPTCHA v3 when user experience is critical, you have the engineering time to set thresholds and monitor false positives, and you want signals across the whole site rather than one form.

Can you use reCAPTCHA v2 and v3 together?

Yes, and it is a popular pattern. You run v3 on all traffic and, only when a visitor’s score falls below your threshold, fall back to a v2 challenge for that one visitor. Normal users stay friction-free; suspicious ones hit a hard gate. The trade-off is that you now maintain two integrations and two sets of keys, and you still own all the threshold logic that v3 requires.

How to migrate between reCAPTCHA v2 and v3

Because the keys are not interchangeable, moving from one version to the other is a small project, not a toggle.

1. Register new keys. In the reCAPTCHA admin console, create a new site for the version you want. v2 and v3 keys are separate.
2. Swap the frontend. For v3, add the script with your site key to every page you want scored and attach actions to key events. For v2, drop in the checkbox or invisible widget on the specific form.
3. Update the backend verification. Both versions verify the token server-side, but v3 returns a score and action you must read. Add your threshold check here.
4. Decide what a low score does. This step is unique to v3 – allow, challenge, moderate or throttle. Without it, v3 blocks nothing.
5. Test with real traffic and tune. v3 scores only make sense against your own audience, so watch the score distribution and adjust the threshold before you start blocking.

Note that reCAPTCHA is also consolidating onto Google Cloud and reCAPTCHA Enterprise, so new keys increasingly run through a Google Cloud project. Factor that into any migration.

The weakness reCAPTCHA v2 and v3 share

Framed as friction vs invisibility, v2 vs v3 looks like a simple trade. But both versions carry the same core limitations, and this is why so many site owners keep looking for something better.

• Neither reads the submission. reCAPTCHA judges whether the visitor looks like a bot. It never looks at the message. A human copy-pasting the same casino or backlink pitch into a hundred contact forms passes reCAPTCHA cleanly – because a human is exactly what they are. Human-driven spam is a large share of what real forms actually receive.
• Bots increasingly get through. CAPTCHA-solving services and bot farms defeat both versions at scale, and v3 scores can be gamed with realistic interaction patterns.
• Friction and lost conversions (v2). Every checkbox and puzzle is a chance for a real customer to give up, and image challenges are a genuine accessibility barrier.
• Silent lost customers (v3). A threshold set too tight blocks real people with no message and no recourse.
• Privacy and compliance questions. reCAPTCHA loads Google scripts and collects hardware, software and behavioral data from the visitor’s device, then shares it with Google. This is a real GDPR exposure, not a theoretical one: in March 2023 the French regulator CNIL fined the company Cityscoot 125,000 EUR, in part for using Google reCAPTCHA on its login and password forms without collecting the user’s consent for the data it sends to Google. If your audience includes the EU, reCAPTCHA is something you may need a consent banner for.
• It now has a meter on it. reCAPTCHA is moving to Google Cloud and reCAPTCHA Enterprise. Even the free tier expects a Google Cloud project with a billing account and covers 10,000 assessments per month; above that the current structure is roughly $8/month up to 100,000 assessments and $1 per 1,000 assessments beyond that.

So the honest answer to “reCAPTCHA v2 vs v3, which is better?” is often “neither, by itself.” Both are bot-signal widgets bolted onto the front of a form. Neither is a spam filter for the content coming through it.

Beyond v2 vs v3: the no-CAPTCHA option

If your real goal is simply less spam and no friction for genuine visitors, there is a third path that sidesteps the whole v2-vs-v3 decision: put an invisible cloud filter in front of your forms that inspects the submission itself. That is where a Google reCAPTCHA alternative like CleanTalk fits.

The approach borrows the best of each version and drops the weakness they share:

• Invisible like v3 – no checkbox, no puzzle, no friction for real users.
• Decisive like v2 – it blocks spam for you, so there is no score threshold to tune and no enforcement code to write.
• Content-aware, unlike either – it evaluates the actual submission (email, IP reputation across a global network, behavior and message text), so it catches human spammers, not just obvious bots.

reCAPTCHA asks “does this visitor look human?” A content filter asks “is this submission spam?” For most contact forms, signups and comment sections, the second question is the one that actually protects the inbox. If you want to compare approaches directly, CleanTalk also documents how it stacks up against reCAPTCHA and hCaptcha for WordPress and why Contact Form 7 users switch from reCAPTCHA.

FAQ: reCAPTCHA v2 vs v3

Is reCAPTCHA v3 better than v2?

Not automatically. v3 is better for user experience because it is invisible, but it requires you to build the enforcement logic, tune the threshold, and it never blocks anyone on its own. v2 is easier to deploy and blocks bots out of the box, at the cost of visible friction. “Better” depends on your form and your team.

What is the main difference between reCAPTCHA v2 and v3?

v2 shows a challenge and returns a pass or fail decision that Google enforces. v3 shows nothing and returns a score from 0.0 to 1.0 that your own code must act on.

Can I use reCAPTCHA v2 and v3 together?

Yes. The common pattern is to run v3 on all traffic and fall back to a v2 challenge only when a visitor’s score is below your threshold. It keeps friction low but means maintaining both integrations and two sets of keys.

Does reCAPTCHA v3 block bots by itself?

No. It only produces a risk score. If you do not write backend logic to reject low scores, nothing is blocked – the most common mistake when moving from v2 to v3.

What score does reCAPTCHA v3 return?

A number between 0.0 and 1.0, where values near 1.0 indicate a likely human and near 0.0 a likely bot. The frequent default threshold is 0.5, but you should tune it against your own false-positive rate.

Can I switch from reCAPTCHA v2 to v3 without new keys?

No. v2 and v3 keys are not interchangeable. You must register new keys and update both the frontend widget and the backend verification.

Is reCAPTCHA still free?

There is still a free tier, but it now runs through Google Cloud and reCAPTCHA Enterprise. The free tier expects a Google Cloud project with billing attached and covers 10,000 assessments per month; beyond that, usage is metered.

Why do bots still get through reCAPTCHA?

Because CAPTCHA-solving services and bot farms defeat both versions at scale, and because neither version inspects the content of the submission. Human spammers pass reCAPTCHA cleanly, so a content-aware filter is needed to catch them.

The bottom line

Treat reCAPTCHA v2 vs v3 as a real trade-off, not a version upgrade. v2 buys you a ready-made block in exchange for user friction. v3 buys you invisibility in exchange for developer work and silent false positives. Both are bot-signal tools, and neither reads the spam it is meant to stop.

• Pick v2 for a low-volume, high-risk form where a visible challenge is acceptable and you want zero configuration.
• Pick v3 (optionally with a v2 fallback) when UX is critical and you have the engineering time to tune it.
• Pick an invisible content filter when your goal is simply less spam with no friction for real visitors – it removes the whole v2-vs-v3 dilemma and blocks the spam that both versions wave through.

Sources and further reading

• Google reCAPTCHA alternative – CleanTalk
• reCAPTCHA v3 score test – CleanTalk
• Akismet vs reCAPTCHA: differences in 2026
• reCAPTCHA and hCaptcha vs CleanTalk for WordPress
• Why Contact Form 7 users switch from reCAPTCHA to CleanTalk
• Anti-spam protection for websites – CleanTalk