Cloudflare Turnstile vs reCAPTCHA vs hCaptcha: which one should you use in 2026?

All three aim to reduce automated abuse. They differ in who sees your visitors' data, whether you need a consent banner, how often a real person gets a puzzle, and what you pay once traffic grows. Here is the short version, with sources, and the self-hosted proof-of-work option that none of the three offers.

Quick verdict

	Cloudflare Turnstile	Google reCAPTCHA	hCaptcha	Bollwark
Visible puzzle	Rarely; a checkbox when risk is high	v2: checkbox, plus a challenge for suspicious visitors; v3: none	Free tier: most users see a challenge	No image puzzle; a checkbox on higher-risk tiers
Cookies on the visitor's device	Only with the optional pre-clearance feature	Yes, _GRECAPTCHA	Yes, e.g. hmt_id (30 days)	None
Where data goes	Cloudflare's network	Google	Intuition Machines, transferred to the US	EU (hosted), or your own server
Free tier	Free, unlimited challenges, up to 20 widgets	10,000 assessments a month	Free (Basic)	1,000 verifies a month, one site
Paid entry point	Enterprise plan	$8 a month flat for up to 100,000	Pro from $99 a month (annual)	Paid plans not on sale yet
Open source / self-host	No	No	No	MIT, one container

Sources for every competitor cell are linked in the sections below.

Privacy and cookies: what each one sends to whom

Turnstile. Cloudflare's privacy addendum lists what it collects: client IP address, TLS fingerprint, User-Agent header, and the site key with its origin. It describes those signals as strictly necessary for bot detection and also uses them to improve Turnstile. The docs mention a cookie only for the optional pre-clearance feature.

reCAPTCHA. Google's FAQ says reCAPTCHA "sets a necessary cookie (_GRECAPTCHA)" for its risk analysis. Since 2 April 2026 Google processes that data as your processor rather than as an independent controller. The script itself loads from google.com and gstatic.com; we measured the main bundle at 850,545 bytes.

hCaptcha. The privacy policy lists first-party cookies such as hmt_id (30 days) plus load-balancing and security cookies, which hCaptcha believes are consent-exempt. It collects mouse movements, scroll position, keypress and touch events, says personal data is transferred to and stored in the United States, and collects puzzle answers as labelled data for machine-learning use that it can disclose to customers.

Bollwark. No cookies and no browser storage. The widget sends four counters and three booleans about the environment, never paths or key values. The IP is truncated to /24 or /48 before anything is logged, and the log is pruned after 72 hours by default. The details, including what we keep and for how long, are in Is reCAPTCHA GDPR compliant?.

Consent banners under GDPR and ePrivacy

The question is not the GDPR first; it is Article 5(3) of the ePrivacy Directive (§ 25 TDDDG in Germany): anything stored on or read from the device needs consent unless an exception applies, most often that it is strictly necessary for the service the visitor asked for. All three vendors argue their cookies are necessary. That can be a defensible position depending on how you implement them, but it is your call as the operator, and if you decide to gate reCAPTCHA or hCaptcha behind consent, the form breaks for anyone who declines.

Avoiding cookies does not take a CAPTCHA out of Article 5(3) on its own: reading information from the device counts too. Bollwark stores nothing on the device and reads only a few browser properties and interaction counts. We consider that strictly necessary for the check, which is the position in our end-user privacy notice, but assess it for your own setup.

User friction: puzzles vs invisible checks vs proof-of-work

• hCaptcha says its free tier "provides a classic CAPTCHA experience in which most users will generally see a challenge" (source). Less friction is a paid feature.
• reCAPTCHA v2 shows a checkbox and challenges visitors it is unsure about; v3 runs "without any user interaction" and returns a score your backend must interpret (source).
• Turnstile tunes difficulty so it can avoid showing a puzzle; its managed widget shows a checkbox only when the visitor looks risky (source).
• Bollwark never shows an image puzzle. Every visitor's browser solves a small proof-of-work puzzle in a Web Worker; low-risk visitors never have to click (in invisible mode they see nothing at all), and higher-risk ones get a checkbox and a harder puzzle. The widget is fully keyboard-operable and announces its state to screen readers.

Pricing and free tiers

• Turnstile: free, with unlimited challenges and up to 20 widgets; Enterprise for more (plans).
• reCAPTCHA: Essentials applies to projects without billing enabled and is free up to 10,000 assessments a month per organisation, after which requests fail. Enabling billing moves you to Premium: free to 10,000, a flat $8 up to 100,000, then $1 per 1,000 (billing).
• hCaptcha: Pro is $99 a month billed annually or $139 monthly for 100,000 evaluations, then $0.99 per 1,000 (pricing).
• Bollwark: a free tier of 1,000 verifies a month on one site. Starter (from €9) and Growth (from €19) are priced but not on sale yet; see pricing. Self-hosting is free.

Self-hosting: only one column says yes

None of the three is open source, and none offers a server you can run yourself on its public plans. If your requirement is that visitor data never leaves your infrastructure, the choice is between open-source proof-of-work projects. Bollwark is one of them: an MIT-licensed Rust binary that runs with one docker run, makes no outbound HTTP calls, and needs no database. See the self-hosted CAPTCHA for what you get.

When to pick which

• Turnstile if you are already on Cloudflare, want the lowest friction for free, and are comfortable with Cloudflare processing the IP, TLS fingerprint and User-Agent.
• reCAPTCHA if you need Google's risk scores in a Google Cloud workflow and have a consent setup you trust.
• hCaptcha if you want an alternative to Google and accept puzzles on the free tier, or pay for Pro.
• Bollwark if you want no cookies, minimal device access, EU-only hosting, or the option to self-host. It is young (version 0.1) and the hosted paid plans are not open yet, so weigh that too. Leaving hCaptcha specifically? Read our hCaptcha alternative page.

FAQ

Which is better, hCaptcha or reCAPTCHA?

They make different trade-offs. reCAPTCHA has the lower paid entry price and less visible friction on v3; hCaptcha keeps you out of Google's network but shows most free-tier visitors a challenge. Both set cookies on the visitor's device.

How much does hCaptcha cost?

The Basic tier is free. Pro is $99 a month billed annually ($139 monthly) for 100,000 evaluations, with Enterprise above that.

Which CAPTCHA is the most effective?

No CAPTCHA stops a determined, funded attacker on its own; each one raises the cost of abuse. The better question is which one stops your actual traffic with the least friction for real people, which is why Bollwark has a monitor mode: it logs what its risk scoring would block without blocking on it, so you can see what it would do before you switch it on. Validation checks, such as an invalid proof, still refuse requests in monitor mode.