What Is reCAPTCHA and How Does It Work? v2, v3 and Scores

reCAPTCHA is Google’s bot check, and it’s the one you’ve almost certainly met. It ships in four flavours: the “I’m not a robot” checkbox, an invisible variant, a silent scoring version, and an Enterprise tier. They look different because they interrupt you differently, but underneath they’re doing the same job.

Here’s how each version decides, how the token flow actually works, and how to tell which one a site is running.

What reCAPTCHA is

It’s a human-verification service Google offers to site owners. Drop a script into a page, and Google tells your backend whether a given interaction looked like a person.

It shows up in front of the things attackers want: login pages, registration, contact forms, checkout, password reset, search. Anywhere a script running unattended would cause damage or cost money.

The important distinction: CAPTCHA is the general category of human-verification tests. reCAPTCHA is Google’s product inside that category. Cloudflare Turnstile, GeeTest and hCaptcha are competitors in the same space.

How reCAPTCHA works

Every version follows the same three steps, and only the middle one changes.

1. The page loads Google’s script, which starts collecting signals.
2. Google decides: pass silently, show a challenge, or score the interaction.
3. Your browser receives a short-lived token, which posts with the form.

The token is the whole mechanism, and it’s the part people miss. Passing a challenge in the browser proves nothing on its own. The site’s backend has to exchange that token with Google:

# The server side of every reCAPTCHA version. Same endpoint.
curl -X POST https://www.google.com/recaptcha/api/siteverify \
  -d secret=YOUR_SECRET_KEY \
  -d response=THE_TOKEN_FROM_THE_PAGE

# {"success":true,"score":0.9,"action":"login","hostname":"example.com"}

Two consequences worth knowing. Tokens expire after about two minutes, so a form left open too long submits a dead one. And a site that never calls that endpoint has no protection at all, however convincing the widget looks.

What Google weighs before issuing the token includes cursor and scroll behaviour, browser and device characteristics, IP history, cookies from previous Google interactions, and timing. That’s why a fresh incognito window on a VPN gets challenged more often than your everyday browser.

The four versions

reCAPTCHA v2 checkbox

The familiar tickbox. Ticking it is not the test: the test is everything measured while you moved toward it. Weak signals get an image grid instead, which is the escalation path rather than a separate product. See reCAPTCHA v2 for how the flow behaves in automation.

Invisible reCAPTCHA

v2 without the checkbox. It binds to your submit button or fires on page load, and most visitors see nothing. When signals are weak, the same image challenge appears. From a site owner’s view it’s v2 with the friction moved out of the happy path.

reCAPTCHA v3

No challenge, ever. It returns a score from 0.0 to 1.0 with every verification, where 1.0 reads as a good interaction and 0.0 reads as a bot, and hands the decision to the site. Google suggests 0.5 as a starting threshold.

This shifts real work onto the site owner: you now choose what a low score costs a visitor. Blocking outright is the common mistake, because it locks out people on corporate VPNs and privacy browsers. Stepping up to a stronger check is the better move. If your own scores are coming back low, we’ve written up the six fixes that move a reCAPTCHA v3 score. The details of the version live on reCAPTCHA v3.

reCAPTCHA Enterprise

A different Google product tier rather than a fifth version. Enterprise runs both v2-style and v3-style flows, and adds reporting, tuning and risk features for organisations that need them. That matters practically: “Enterprise” and “v3” are independent settings, and something can be v2 Enterprise or v3 Enterprise. reCAPTCHA Enterprise covers the differences.

How to tell which version a site runs

Open the page source and look at the script it loads.

The sitekey itself tells you nothing, since they all look alike. Trust the script.

v2 or v3, and what each costs you

Neither is simply better. They fail in opposite directions.

v2 is honest with users. There’s a visible step, people understand they’re being checked, and a pass or fail is unambiguous. The cost is friction on every single visitor, including the ones who were never a risk.

v3 is invisible and cheap for good traffic, and it pushes the hard decision onto you. Get the thresholds wrong and you either wave bots through or quietly block customers with no explanation and no way to appeal. That failure mode is worse precisely because it’s silent.

The usual sensible answer: v3 across the site to grade traffic, and a v2 challenge held in reserve for anything that scores badly on an action that matters.

Frequently asked questions

Summary

reCAPTCHA collects signals, decides, and hands your browser a token your backend has to verify with Google. v2 asks openly, Invisible asks only when it’s unsure, v3 never asks and scores instead, and Enterprise is a tier that runs either style with more control on top.

Check the script tag to find out which one you’re dealing with, and remember the token expires in about two minutes. If you’re testing your own forms and need to get past the check reliably, CapSkip does captcha bypass locally, on your own machine.