A bot-mitigation and fraud-prevention service for websites, provided by the US company Intuition Machines. Released in 2018, it offers an API compatible with Google’s reCAPTCHA, so existing implementations can be switched over with just a few lines of code. Beyond the traditional image-selection challenge, it also provides a “passive mode” that uses risk scores and behavioral analysis to show nothing at all to most users. Built on a design that collects no personally identifiable information (PII), it is easy to adopt for sites that must comply with regulations such as GDPR, CCPA, and LGPD.
Key Features
- reCAPTCHA-compatible API: Adding a script tag and a
div, plus changing the server-side verification endpoint, is enough to get started. The migration cost from an existing reCAPTCHA implementation is small - Zero PII design: Built on the premise of not collecting personally identifiable information, with stated compliance for GDPR, CCPA, LGPD, PIPL, and more. It also holds ISO 27001, SOC 2 Type II, and PCI DSS certifications
- Risk scores and behavioral analysis: Risk is evaluated from a large number of signals such as IP addresses and interaction patterns, and judged continuously across the whole session. Attackers spread across many IPs can still be detected as a cluster
- Passive mode (No-CAPTCHA): On higher plans, most legitimate users never see a challenge, and only suspicious traffic is asked to verify. The company describes this as “99.9% passive” operation
- Fraud prevention beyond bot mitigation: Account takeover (ATO) detection, countermeasures for multi-accounting, transaction fraud and incentive abuse, and a push-based MFA that can replace SMS are offered as modules
- Detection built for the AI agent era: The company focuses on identifying access from automation tools and AI agents, and published findings on this theme in 2026 as well
Pricing
| Plan | Price | What’s included |
|---|---|---|
| Basic (Free) | $0 | Core bot protection, works in every region, compliance with GDPR, CCPA, LGPD, PIPL, and more |
| Pro | $139/month ($99/month equivalent when billed yearly) | Everything in Basic, plus low-friction passive mode, custom themes, and analytics. Includes 100K monthly evaluations, then $0.99 per 1,000 |
| Enterprise | Contact sales | Everything in Pro, plus risk scores, No-CAPTCHA mode, mitigation for advanced attacks, SLAs, a multi-user dashboard, SAML SSO, and analytics/reporting APIs |
Pricing is as of August 2026. Check the official site for the latest details.
Pros & Cons
✅ Pros
- Being reCAPTCHA-compatible, migrating an existing site takes very little time
- Even the free plan covers the main bot-mitigation features, making it practical for personal sites and small services
- The no-PII design makes privacy policies and consent flows easier to explain
- Bot detection, account takeover, and payment fraud can all be handled on the same platform
- A good fit when you want to avoid depending on Google services, or need coverage across a wide range of regions including mainland China
⚠️ Cons
- The entry point for paid plans is $99/month (billed yearly), which is heavy for small sites
- Most of the features that reduce friction, such as passive mode and risk scores, are limited to Pro and above
- When an image challenge does appear, it can cause users to drop off
- Advanced features are modular, so Enterprise costs are hard to estimate without a quote
- The dashboard and documentation are primarily in English, with limited material in other languages
Comparison with Similar Services
| Criteria | hCaptcha | reCAPTCHA | Cloudflare Turnstile | Arkose Labs |
|---|---|---|---|---|
| Provider | Intuition Machines | Cloudflare | Arkose Labs | |
| Pricing | Free plan available; Pro at $99/month equivalent when billed yearly | Free tier available; Enterprise is usage-based | Free | Contact sales |
| Handling of personal data | Explicitly Zero PII | Follows Google’s policies | States that it does not collect PII | Varies by deployment |
| Challenge format | Image challenge plus passive mode | Image challenge plus score-based judgment | Near-invisible widget | Puzzle-style challenge |
| Fraud prevention | ATO detection, payment fraud, MFA, and more | Offered on Enterprise | Focused on bot mitigation | Specialized in fraud prevention |
Who Is It For
- Site operators already using reCAPTCHA who are looking for an alternative for privacy reasons or to diversify vendors
- Individuals and small services struggling with spam submissions to signup or contact forms
- Businesses that want to minimize the data handed to external services from a GDPR or privacy-compliance standpoint
- Service operators who want to cover account takeover and payment fraud on the same platform as bot mitigation
- Developers who want to test the effect within the free tier first and move to a paid plan as needed
Summary
hCaptcha combines the convenience of reCAPTCHA compatibility with a Zero PII design principle. The free plan alone works well as form-spam protection, and as traffic grows, Pro and above reduce friction through passive mode and risk scores. A reasonable approach is to start by adding the free plan to your existing forms, then consider a higher tier while watching how pass rates and drop-offs change.