What is reCAPTCHA? Definition, versions and how it works

What is reCAPTCHA?

reCAPTCHA is a bot-detection tool that a website embeds on forms, logins and checkouts to block automated submissions. The name comes from CAPTCHA, a “Completely Automated Public Turing test to tell Computers and Humans Apart”, a term associated with Carnegie Mellon researcher Luis von Ahn. The original reCAPTCHA had a second purpose: users typed words that OCR software could not read, which helped digitise books and, according to The Register, the archive of The New York Times.

How does reCAPTCHA work?

reCAPTCHA works by analysing signals about the visitor’s browser and behaviour and returning a verdict or a risk score to the site’s server. A typical integration has four parts:

1. Load the reCAPTCHA script on the page with a site key.
2. Collect interaction signals in the background or through a checkbox or image challenge.
3. Send the resulting token to your backend with the form data.
4. Verify the token with Google and accept, challenge or block the request.

reCAPTCHA versions

reCAPTCHA has moved from typing distorted text to invisible risk scoring in 3 major steps.

reCAPTCHA v1 (2007)

reCAPTCHA v1 asked users to retype two distorted words, one of them taken from scanned books. Google retired this approach after its own research showed that software could solve even the hardest text CAPTCHAs almost perfectly.

reCAPTCHA v2 (2014)

reCAPTCHA v2 introduced the “I’m not a robot” checkbox, announced on 3 December 2014, with image challenges such as “select all traffic lights” only for suspicious visitors. An invisible v2 variant followed in 2017.

reCAPTCHA v3 and Google Cloud

reCAPTCHA v3 runs without any user interaction and returns a score from 0.0 (likely bot) to 1.0 (likely human). Google’s documentation suggests a starting threshold of 0.5 that each site tunes on its own traffic. The current product lives in Google Cloud in three tiers: Essentials (free up to 10,000 assessments a month), Premium ($8 flat fee for 10,001 to 100,000 assessments, then $1 per 1,000) and Enterprise with a 12-month commitment.

reCAPTCHA in marketing and SEO

reCAPTCHA matters to marketers because it protects lead data quality but adds friction that can lower the conversion rate. Spam submissions inflate form completions in analytics and pollute the CRM with fake leads. Visible image challenges have the opposite effect: they slow real users down, and Google’s help pages admit that reCAPTCHA does not support deafblind users. For SEO, reCAPTCHA has no direct ranking effect, but its script loads on every page where it is embedded, so I load it only on pages with forms to protect Core Web Vitals (more in my guide to mobile SEO).

Privacy is the other trade-off. Critics point out that the script sends behavioural data to Google, which matters under GDPR in the EU. Cloudflare moved from reCAPTCHA to hCaptcha in April 2020 and launched its own cookie-free alternative, Turnstile, on 28 September 2022.

reCAPTCHA v2 vs v3