“reCAPTCHA v2 or v3: which should I use?”
reCAPTCHA v2 or v3: which should I use?
Short answer
v2 shows each visitor a challenge, usually a checkbox with image puzzles as backup, and returns pass or fail. v3 never shows anything: it scores every action from 0.0, very likely a bot, to 1.0, very likely human, and you decide the threshold, 0.5 by default, then act behind the scenes. Pick v2 for simple forms that need a clear yes or no, v3 for flows you can score and act on quietly.
Side by side
reCAPTCHA v2 vs v3, from Google's developer documentation.
| Feature | reCAPTCHA v2 | reCAPTCHA v3 |
|---|---|---|
| What the visitor sees | A checkbox, with image challenges when unsure | Nothing, the check is invisible |
| Result | Pass or fail | A score from 0.0 to 1.0 |
| Default threshold | Not applicable | 0.5, adjustable |
| Token lifetime | Two minutes | Two minutes |
| Best fit | Simple forms needing a clear yes or no | Login and checkout flows you can score |
How v2 works
v2 shows the familiar I'm not a robot checkbox. Confident visitors pass with a click; doubtful ones get an image challenge such as picking out traffic lights. The result is binary, your server verifies one token, and you block or allow. Simple to reason about, visible to everyone, and sometimes a puzzle stands between a person and your signup form.
How v3 works
v3 runs without any interaction. On each action you care about, such as a login attempt, the page calls grecaptcha.execute and receives a token that your server exchanges for a score between 0.0 and 1.0. Google describes 1.0 as very likely a good interaction and 0.0 as very likely a bot. The score comes back together with the action name, so you can check that it belongs to the form it was minted for.
Because you get a score instead of a verdict, Google recommends you take action behind the scenes instead of blocking: require a second factor, flag the account for review, or step the visitor up to a v2 challenge. You choose the cutoff.
Choosing a threshold
Google's docs suggest a default threshold of 0.5 and tuning from there: capture scores for a while without acting, look at the distribution for real abuse versus real customers, then move the cutoff. Set it too high and honest visitors start failing; too low and bots walk through.
v2 has no threshold to tune, which is either its weakness or its simplicity, depending on how much traffic you have to calibrate on.
Tokens and verification
Both versions verify server-side: your backend posts the token and your secret to Google and reads the result. reCAPTCHA tokens expire after two minutes, so the verify call must happen promptly after the action. In v3, every scored action needs a fresh execute call and its own token.
This single-use, short-lived token design is shared by other providers too; see CAPTCHA token expired or already used for how the failure modes look.
Does this choice still matter in 2026?
Google now markets Fraud Defense as the next evolution of reCAPTCHA, and the v3 docs page carries a deprecation notice pointing to it. Existing v2 and v3 keys keep working, so nothing forces a change, but new integrations should start from Fraud Defense. See is reCAPTCHA going away.
If neither feels right
v2 puzzles frustrate some visitors, and v3's scoring depends on Google's cookies, which is its own problem under consent rules; see reCAPTCHA and GDPR cookie consent. Cookie-free and game-based options exist, compared in reCAPTCHA alternatives.
Questions
Is v3 better than v2?
Neither is better outright. v3 is quieter and needs traffic to tune a threshold; v2 is simpler and visible.
Does reCAPTCHA v3 ever show a challenge?
No. v3 only scores. You can use the score to decide to show a v2 challenge yourself.
What reCAPTCHA v3 score means bot?
0.0 is very likely a bot and 1.0 is very likely a good interaction. Google's suggested default threshold is 0.5.
How long is a reCAPTCHA token valid?
Two minutes, per Google's developer docs, so verify it promptly after each action.
Can I use v2 and v3 on the same site?
Many sites run both, scoring quietly with v3 and escalating unsure visitors to a v2 challenge. Each check uses its own token.
Which should I use on a login form?
v3 fits logins well: score quietly, then step up to a second factor or a visible challenge when the score is low.
Is reCAPTCHA v3 deprecated?
Its docs page is marked deprecated and points to Fraud Defense, but existing keys keep working.
Sources
- Google reCAPTCHA v3 docs (checked 2026-10-18)
- Google reCAPTCHA v2 widget docs (checked 2026-10-18)
- Google Cloud blog: Fraud Defense announcement (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.