Learn how does modern CAPTCHA works. Compare Google reCAPTCHA, Cloudflare Turnstiles, and more providers from features, pricing, and integration tips.
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response system used to distinguish human users from automated program or bots. It presents tasks that are easy for humans but hard for machines.
For example, a traditional CAPTCHA might show distorted letters or numbers and ask the user to type them. By leveraging human pattern recognition, CAPTCHAs block most scripts and spam bots from abusing online forms and services.
Classic CAPTCHAs rely on tasks like interpreting distorted text or selecting specific images. The distortion (e.g. warped letters overlaid with noise) foils simple OCR (Optical Character Recognition) algorithms.
Modern CAPTCHA solutions have evolved into several categories:
Using CAPTCHA is a trade-off between security and user experience. When selecting a CAPTCHA service, key considerations include:
CAPTCHAs are effective against basic bots, but determined attackers have countermeasures. Advanced scripts or AI-driven bots can sometimes bypass CAPTCHAs using OCR/image recognition and machine learning. There are even anti-CAPTCHA or solver services (often called bypass-as-a-service) where attackers pay humans or specialized AI to solve CAPTCHAs at scale. For example, Google once reported that older text CAPTCHAs could be solved by bots over 99% of the time.
However, modern non-interactive and invisible CAPTCHAs, like behavior-based or cryptographic background checks, offer better defense to AI attack. Notably, bot traffic is now enormous: On the order of 51% of all internet traffic, with 37% being malicious. So having some CAPTCHA or bot-detection is important even if it is not foolproof.
Besides, adding multi-layered bot protection is necessary, such as device fingerprinting (e.g., via passkeys), rate limiting, Multi-Factor Authentication.
Any CAPTCHA adds friction for users. Studies show only about 66% of humans enter a CAPTCHA correctly on the first try, meaning many may get frustrated or abandon a form. For example, lengthy image puzzles or multiple re-attempts can lower conversion rates.
To mitigate this, modern CAPTCHA providers focus on minimizing human effort. Strategies include:
Cloudflare reports that Turnstile “eliminate the frustrating experience of CAPTCHAs” so real users “no longer have to waste time and effort solving visual puzzles”. In practice, many sites only show a checkbox or image challenge when a user’s behavior looks suspicious; normal users may see nothing at all.
Today, more and more AI agents are emerging, designed to automate tasks and interact with third-party services.
Many domain-specific AI agents connect safely and legitimately to third-party apps using standard protocols like OAuth and MCP (Model Context Protocols). This is a secure, approved way to grant an agent access which make users to authorize smoothly.
However, some ambitious “general-purpose” AI agents aim to fully replace human browsing actions. For example, Manus is designed to automate everything a person might do in a web browser, from filling in forms to signing in with a username and password. In real-world tests, Manus struggle to get past modern high-security CAPTCHAs such as Cloudflare Turnstile and Google reCAPTCHA Enterprise, even if the user tries to “hand off” the session to a real person to solve the challenge manually. If you’re building an AI agent, it’s important to design your authentication flows carefully. Relying on browser automation to log in like a human is increasingly impractical because strong CAPTCHAs are extremely good at blocking bot-like interactions.
CAPTCHA services range from free to paid. Free plans often limit usage or have basic features. For example:
Be sure to check each provider’s plan limits and pricing for your expected traffic and conversion goals.
CAPTCHAs are typically deployed wherever bots can cause trouble. Common scenarios include:
By inserting CAPTCHAs at these touchpoints, you significantly reduce automated abuse while keeping the system open to legitimate users.
| CAPTCHA provider | User experience | Plan & pricing |
|---|---|---|
| reCAPTCHA v2 (Google) | Users must click a ”I'm not a robot“ checkbox. This click might or might not challenge them with CAPTCHA image puzzles. | Free (Essentials) for up to 10K assessments/mo; then paid tiers (Standard/Enterprise). Enterprise costs $8 up to 100K and $1 per additional 1K. |
| reCAPTCHA v3 (Google) | Invisible, background risk scoring (no user challenge). | Same pricing tiers as reCAPTCHA v2 |
| reCAPTCHA Enterprise (Google) | Two interactive modes: 1. Score-based (no challenge). 2. Checkbox and adaptive visual challenge. | Volume-based pricing: free up to 10K; $8 up to 100K; $1/1K beyond. Offers extra features like account defender and SMS fraud protection. |
| Cloudflare Turnstile | Three interactive modes: 1.Managed: Cloudflare logic determines which users see checkbox widget. 2. Non-interactive: All user see auto-loading widget, but never interact with the widget. 3. Invisible: Visitors will never see or interact with the widget. Invisible challenges should take a few second. | Almost completely free. Free plan: Up to 20 CAPTCHA widgets, 15 hostnames per widget, unlimited volume. Enterprise plan: Unlimited widgets. |
| hCaptcha | Interactive image classification tasks (similar to reCAPTCHA v2). Focuses on privacy, but puzzles can be complex. | Free up to 100k requests per month. Pro plan ~$99/mo. Enterprise custom plans. |
| FunCaptcha (Arkose Labs) | Gamified micro-games (rotate/slide objects, simple quizzes). More engaging puzzles intended to defeat bots. | No free tier. Only provide Enterprise solution (part of Arkose Bot Management) and contact for pricing. |
| Friendly Captcha | Fully invisible proof-of-work puzzle. No user action needed with all solved in the background. | Free non-commercial tier (1 domain, 1000 requests). Paid plans: Starter €9/mo (1K req); Growth €39/mo (5K req); Advanced €200/mo (50K req); Enterprise custom. |
| BotDetect (Captcha.com) | Traditional image or audio CAPTCHA with letters/numbers. | Self-hosted and License-based. No free plan. APT license fee about $99/year. |
Among these, Cloudflare Turnstile stands out today. It’s free, easy to integrate, and unobtrusive. Turnstile delivers robust bot blocking without forcing puzzles on legitimate users, and it “never harvests data for ad retargeting”, fully respecting user privacy. For most sites, Turnstile offers the best balance of security, UX, and cost.
The easiest way to add CAPTCHA is to use an integrated identity platform.
Logto, a developer-friendly IAM solution, supports top providers like Google reCAPTCHA Enterprise and Cloudflare Turnstile, so you can enable CAPTCHA in just a few clicks.
With Logto, your team can secure your entire authentication flows without dealing with complex implementation work, including sign-up, sign-in, account recovery, SSO, MFA, multi-tenant management, etc. Learn more about Logto’s CAPTCHA or reach out to the team if you’d like explore more CAPTCHA provider options.