Turnstile vs reCAPTCHA vs hCaptcha for web forms

In the Turnstile vs reCAPTCHA vs hCaptcha choice, most small sites are best served by Cloudflare Turnstile: it usually checks visitors without asking them to do anything, and it isn’t tied to an advertising business. hCaptcha is a solid privacy-minded alternative that more often shows a challenge. reCAPTCHA is the most familiar name and works well, but it sends visitor signals to Google, which some site owners would rather avoid.

All three stop a lot of automated spam. The differences are in what your visitors see, what data leaves their browser, and how much setup you want to do.

First: do you need a captcha at all?

Often you don’t. Hidden honeypot fields, spam scoring and rate limits catch most form spam without your visitors noticing anything. FormDoc runs spam scoring and rate limits on every form, and the honeypot works as soon as you add its hidden field, as covered in how to stop form spam.

A captcha is the next step when spam still gets through: a targeted bot, a persistent human spammer, or a form that’s popular enough to attract attention. Every captcha adds some friction, even the invisible ones (a script to load, a small delay, an occasional challenge). So add one when you need it, not by default.

How each captcha works

Cloudflare Turnstile runs a set of small checks in the browser and decides whether the visitor looks human. Most of the time this happens silently or with a brief “verifying” state. Visitors rarely have to click on anything, and image puzzles aren’t part of how it works.

hCaptcha works in a similar way to the classic captcha: it may let visitors through with a checkbox, or ask them to pick images that match a description. It’s often chosen by site owners who want an alternative to Google with a privacy focus.

Google reCAPTCHA comes in a few versions. The checkbox version (“I’m not a robot”) may show image challenges. The score-based version runs in the background and returns a score for how likely the visitor is to be human, leaving you to decide what to do with low scores.

In every case the pattern is the same: the widget in the browser produces a token, the token is sent along with the form, and the server checks it with the provider. If the check fails, the submission is rejected.

Turnstile vs reCAPTCHA vs hCaptcha side by side

	Turnstile	hCaptcha	reCAPTCHA
Run by	Cloudflare	An independent captcha company	Google
Typical visitor experience	Usually no interaction	Checkbox, sometimes image puzzles	Checkbox and puzzles, or invisible scoring
Privacy angle	Positioned as privacy-first, no ads business behind it	Positioned as privacy-first	Part of Google’s services, so worth mentioning in your privacy notice
Familiarity to visitors	Growing	Moderate	Very high
On FormDoc	All plans	All plans	Paid plans

Check each provider’s current terms and pricing before you decide. They change over time, and the right choice also depends on what your own privacy notice says.

Visitor experience: the deciding factor for most forms

Think about who fills in your form. Someone on a phone, on a slow connection, maybe in a hurry, wanting to ask a question. Every puzzle is a moment where they might give up.

That’s why the best captcha for forms is usually the one visitors don’t notice. Turnstile is strong here, because most people never see a challenge. hCaptcha and the checkbox version of reCAPTCHA work well too, but image puzzles can be frustrating, and they can be hard for people who use screen readers or have low vision. If you pick one of those, test it with a keyboard and on a small screen before you launch.

Score-based reCAPTCHA is also invisible, but it gives you a number rather than a pass or fail, so you need to choose a threshold and decide what happens to borderline submissions.

Privacy: choosing a privacy-friendly captcha

Every captcha runs a script from a third party and sends some information about the visitor to that provider. That’s how they tell humans from bots. The questions to ask are:

• Who receives the data? A company whose main business is advertising, or one that isn’t?
• Do you need to mention it? Usually yes. List the captcha provider in your privacy notice either way.
• Do you need consent? That depends on your audience and the law where they live. If you serve visitors in the EU or India, take advice on this rather than guessing.

If privacy is a selling point for your site, Turnstile or hCaptcha are the easier fit. Either way, captcha choice is only one part of form privacy: FormDoc also encrypts submissions before storage and keeps IP addresses only as a one-way hash, which you can read about on the privacy page.

Setting up a captcha with FormDoc

The setup is the same shape for all three providers:

1. Create a site in the provider’s dashboard and get a site key (public) and a secret key (private).
2. In your FormDoc form’s settings, choose the provider and paste in the secret key.
3. Add the provider’s widget script and widget element to your form, using your site key.

For Turnstile, the widget element looks like this inside your form:

<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

The widget adds its token to the form as a hidden field, and FormDoc verifies it on the server when the form is submitted. If the check fails, the submission is rejected with a clear error, and nothing is emailed. Turnstile and hCaptcha are available on every plan, while reCAPTCHA is on paid plans (see pricing).

Common questions

Which captcha is best for a small business website?

For most small sites, Cloudflare Turnstile is a good default because visitors rarely have to do anything. Start with no captcha at all, rely on the honeypot and spam scoring, and add Turnstile only if spam still arrives.

Can I switch captcha providers later?

Yes. Change the provider and secret key in your form’s settings, then swap the widget on your page. Do both at the same time, because a token from one provider won’t pass a check meant for another.

Do captchas stop all spam?

No. They stop most automated submissions, but a determined human can still solve one. That’s why captchas work best as one layer alongside honeypots, spam scoring and rate limits, rather than as the only defence.

Pick the lightest layer that works

Start simple, measure what gets through, and add a captcha only when you need it. You can see all of FormDoc’s spam layers on the features page, and get a free key at app.formdoc.dev/new to try them on your own form.