---
title: "reCAPTCHA vs hCaptcha vs Turnstile for an AI agent"
description: "reCAPTCHA, hCaptcha and Cloudflare Turnstile compared by what each asked of an AI agent's browser in August 2026: a score, a puzzle, 35 seconds or no click at all."
canonical: "https://scalebrowser.net/blog/captcha-comparison"
last_modified: "2026-11-04"
published: "2026-11-04"
author: "davide"
category: "challenges"
---
> ## Documentation Index
> Fetch the complete documentation index at: https://scalebrowser.net/llms.txt
> Use this file to discover all available pages before exploring further.
# reCAPTCHA vs hCaptcha vs Turnstile for an AI agent
> reCAPTCHA, hCaptcha and Cloudflare Turnstile compared by what each asked of an AI agent's browser in August 2026: a score, a puzzle, 35 seconds or no click at all.
A site that switches its challenge vendor changes what your agent has to do on the next run, from nothing at all to half a minute of image tasks. Comparisons of the three usually rank them by privacy or price for the site owner. We compared them by what each actually asked of an agent's browser on live pages with production keys between 4 and 14 August 2026.
## What are reCAPTCHA, hCaptcha and Turnstile?
reCAPTCHA, hCaptcha and Cloudflare Turnstile are the three challenge services most sites embed to decide whether a visitor is a person, and they differ first in what a visitor sees by default. Google's reCAPTCHA v3 shows nothing: its [documentation](https://developers.google.com/recaptcha/docs/v3) says "reCAPTCHA v3 will never interrupt your users" and returns a score where "1.0 is very likely a good interaction, 0.0 is very likely a bot", with 0.5 as the suggested threshold. reCAPTCHA v2 in its checkbox variant shows a checkbox that sometimes opens an image puzzle. hCaptcha shows a checkbox and image tasks, and Cloudflare Turnstile decides per request whether the visitor has to click.
| Service | Owner | What a visitor sees by default | What the site receives |
| --- | --- | --- | --- |
| reCAPTCHA v3 | Google | nothing | a score from 0.0 to 1.0 |
| reCAPTCHA v2 checkbox | Google | a checkbox, sometimes an image puzzle | a token |
| hCaptcha | hCaptcha | a checkbox and image tasks, set by the site's difficulty level | a token |
| Turnstile | Cloudflare | managed: a widget that passes by itself or asks for one click; invisible: nothing | a token |
## What does each one ask of an agent?
Each one asked something different of our agent: Turnstile mostly nothing, reCAPTCHA v2 a picture puzzle, hCaptcha a timed set of image tasks. The agent worked every row through its own tools, and a row counts only if the page moved on.
| Service and variant | Measured on | What it asked | Time | Result |
| --- | --- | --- | --- | --- |
| Turnstile, managed | 5sim login | no interaction | token in 1.7 seconds | passed |
| Turnstile, invisible | Cloudflare dashboard login | no interaction | token in 2.9 seconds | 2 of 2 passed |
| Turnstile, forced checkbox | Cloudflare sign-up | one click on the checkbox | not recorded | failed twice on 4 August, 2 of 2 passed on 14 August |
| reCAPTCHA v3 | Google's demo | no interaction | not recorded | score 0.9 in 2 runs, the same as ordinary Chrome |
| reCAPTCHA v2 | Google's demo | an image puzzle, as for ordinary Chrome | first attempt | 3 correct tiles, passed |
| reCAPTCHA v2, audio | Google's demo | a spoken clip | transcribed in 1.3 seconds | passed |
| hCaptcha | a third-party deployment | two pages of image tasks | about 35 seconds per set | 4 of 4 passed |
| hCaptcha | hCaptcha's own demo | the same image tasks | same | no token for correct answers |
Two rows prove less than they seem to. reCAPTCHA v3 returned a constant 0.9 on a fresh key without visitor history, to every browser we tried, so the score separates nothing on a demo. And reCAPTCHA v2 opened its puzzle for ordinary Chrome on the same line in the same minute, so the puzzle was the demo's answer to that line, not a verdict on our browser.
## Which is harder for bots?
None of the three is harder for bots in general, because the site key and its settings decide more than the vendor does. The clearest case is hCaptcha: the same browser, in the same minute, on the same line, with correct answers, got a token on a third-party deployment and none on hCaptcha's own demo. hCaptcha's [FAQ](https://docs.hcaptcha.com/faq) explains the lever: publishers choose between "Easy, Medium, Difficult, and Auto", and "Setting the value to Auto means the user will always be presented with a challenge". The owner of the key, not the brand on the widget, sets how hard the next step is.
Measured by effort, our agent's order was clear on these pages. Turnstile asked for nothing in 2 of its 3 variants, reCAPTCHA v2 asked for one puzzle a person also gets, and hCaptcha cost about 35 seconds per set of two pages inside a window that closes after about two minutes. All [three challenge providers](/blog/captcha-solving) ended in a pass on at least one deployment, and each also has a deployment or a day where the same agent got nothing.
### How does Cloudflare Turnstile differ from reCAPTCHA?
Cloudflare Turnstile differs from reCAPTCHA in that it replaces the puzzle with checks the browser runs by itself. Cloudflare's [launch post of 28 September 2022](https://blog.cloudflare.com/turnstile-private-captcha-alternative/) describes "a rotating suite of non-intrusive browser challenges based on telemetry and client behavior", among them "proof-of-work, proof-of-space, probing for web APIs". Its [widget documentation](https://developers.cloudflare.com/turnstile/concepts/widget/) adds that managed mode "automatically chooses between non-interactive or checkbox challenge based on visitor risk level". reCAPTCHA splits the same job in two products: v3 returns a score and leaves the decision to the site, v2 asks the visitor to prove it with a puzzle.
| Question | Turnstile | reCAPTCHA v3 | reCAPTCHA v2 checkbox |
| --- | --- | --- | --- |
| Does the visitor act? | only if a further check is needed | never | always the checkbox, sometimes a puzzle |
| Who decides the outcome? | Cloudflare, per request | the site, from the score | Google, from the answer |
| Needs the Cloudflare network? | no | no | no |
## So which should you expect on a given site?
Expect the vendor's default only on a demo; on a real site, expect whatever the key's owner configured. The table sums up what our runs support.
| Situation | What to expect | Why |
| --- | --- | --- |
| Turnstile on an ordinary login | a token without a click | managed mode asked for no click on 5sim |
| Turnstile on the vendor's own sign-up | a checkbox | Cloudflare asked for one on its own page |
| reCAPTCHA v2 on a demo | an image puzzle, as for ordinary Chrome | on the same line the demo gave it to both browsers |
| reCAPTCHA v3 anywhere | a score you never see | only the site reads it |
| hCaptcha on a strict key | image tasks, possibly no token | the publisher's difficulty level decides |
Our verdict: a comparison that ranks the three by difficulty ranks their demos. For an agent, the useful questions are which variant a site runs, which the page shows before the first click, and how strict its key is, which only a run shows.