Comparison

CaptchaKit vs Google reCAPTCHA: which one fits your forms?

Updated October 17, 2026By the CaptchaKit team

Short answer

CaptchaKit and Google reCAPTCHA both stop bots on forms, but they ask different things of your visitors and your budget. reCAPTCHA is free up to 10,000 assessments a month and sets a _GRECAPTCHA cookie. CaptchaKit shows a short arcade game, is pay what you want, and its privacy policy states it uses no advertising or tracking cookies.

PricePay what you want, one time, all 18 gamesFree to 10,000 assessments a month, then $8 flat to 100,000

What the visitor doesPlays a short arcade gameVisual bot challenges in every tier

CookiesPrivacy policy: no advertising or tracking cookiesDocuments a _GRECAPTCHA cookie

Past the free limitLifetime access, unlimited domainsRequests return a 429 error on Essentials

Side by side

CaptchaKit and Google reCAPTCHA side by side. Prices as of October 2026.

CaptchaKit and Google reCAPTCHA side by side. Prices as of October 2026.
Feature	CaptchaKit	Google reCAPTCHA
Price model	Pay what you want, one time, for the full pack. Business is $29 a month.	Essentials free to 10,000 assessments a month. Premium $8 flat for 10,001 to 100,000, then $1.00 per 1,000. Enterprise $1 per 1,000 on a 12-month commitment.
What the visitor does	Yes Plays a short arcade game. Listed average play time is 6 to 20 seconds.	Visual bot challenges are listed in all tiers.
Cookies	Yes Privacy policy: no advertising or tracking cookies. A session cookie keeps account holders logged in.	Google documents a _GRECAPTCHA cookie set when reCAPTCHA runs for risk analysis.
Regulator view	Privacy policy states no fingerprinting, tracking pixel, behavioral profiling or cross-site tracking.	France's CNIL found reCAPTCHA cookies were placed without consent (SAN-2023-003, March 2023).
Server-side check	Yes POST to /api/verify with a Bearer API key. Pass token is a signed JWT, valid 10 minutes, one use.	Yes Your server sends an assessment request to Google Cloud.
Number of challenge styles	Yes 18 arcade games, with an optional in-widget game switcher.	Visual bot challenges.
Domains	Yes Lifetime access with unlimited domains on the game pages.	Free allowance counts across your whole organization.
Account to start	Yes Stripe checkout, pay what you want from $1.	Premium applies once billing is enabled on a Google Cloud project.
WordPress	Yes Plugin on wordpress.org: login, registration, comments, WooCommerce checkout.	Widely supported by CMS plugins.

The short version

reCAPTCHA is the default most people know. Google sells it in three tiers inside Google Cloud, and the first tier costs nothing until your organization passes 10,000 assessments in a calendar month. CaptchaKit is a smaller product with a different idea: instead of clicking images, your visitor plays a short arcade game, and your server checks a signed token.

The honest question is what you give up and what you get. With reCAPTCHA you get Google's scale and a long list of existing plugins. With CaptchaKit you get a challenge that looks like part of your brand, a privacy policy that rules out advertising and tracking cookies, and a price you set yourself.

Price: free allowance versus pay what you want

Google's Essentials tier is free for up to 10,000 assessments per calendar month, counted across your whole organization, not per site. Past that, requests on Essentials return a Resource Exhausted (429) error until the next month. Premium starts when you enable billing: $8.00 flat for 10,001 to 100,000 assessments, then $1.00 per 1,000. Enterprise is $1 per 1,000 as a fixed monthly volume commitment with a 12-month minimum (checked October 2026).

CaptchaKit's pricing page is pay what you want. You choose what to pay for the full pack of all 18 games or for a single game, and access is lifetime with unlimited domains. If you want the analytics dashboard, signed webhooks, team seats, two-factor auth, audit logs, data export and priority support, Business is $29 a month.

If your traffic is under 10,000 assessments a month, reCAPTCHA's price is hard to beat on paper. The difference shows up when traffic grows, when you run several sites against one quota, or when you would rather not tie the CAPTCHA to a Google Cloud billing relationship.

What your visitor sees

reCAPTCHA's challenges are visual bot challenges. CaptchaKit shows one of 18 arcade games: Connect 4, Pac-Man Lite, Whack-a-Bot, Maze Runner, Skee-Ball and others. Each game lists an average play time between 6 and 20 seconds, and the docs suggest matches for form types, such as Whack-a-Bot for login forms and Stack It for comment forms.

Some visitors cannot or do not want to play. Every CaptchaKit widget shows a "Can't play? Accessible check" link that switches to a screen-reader-friendly question and issues the same pass token, so your server code does not change. All games can be played from the keyboard and announce progress through live regions. Test the widget on your own page with the assistive tools your audience uses.

Cookies and privacy

Google's own FAQ documents that reCAPTCHA sets a necessary cookie, _GRECAPTCHA, when it runs for risk analysis. The French regulator CNIL, in deliberation SAN-2023-003 of 16 March 2023, found that reCAPTCHA cookies had been placed on a site without information or consent. Our answer on reCAPTCHA and GDPR goes through it. This is not legal advice.

CaptchaKit's privacy policy says no advertising or tracking cookies are used, with one session cookie that keeps account holders logged in. For your visitors, it says CaptchaKit receives only the game outcome and a timestamp, with no fingerprinting, tracking pixel, behavioral profiling or cross-site tracking. Standard server logs, including IP addresses, are kept for up to 90 days for security and abuse prevention. Ask your own counsel what that means for your consent banner.

How verification works

In both products your server, not the browser, decides whether a form is allowed. CaptchaKit's flow: the widget loads from captchakit.com in an iframe, the visitor wins a game, and a signed pass token appears in the widget's data-token attribute. Your server sends the token and site key to POST /api/verify with a Bearer API key and gets { "success": true }. The token expires after 10 minutes and works once, so a replayed token is rejected.

Before a token is issued, the game must request a single-use challenge, play for at least 1.2 seconds and report interaction, and requests are rate limited per site key. These controls raise the cost of abuse. They do not make a client-side game unbeatable, so pair CaptchaKit with other checks on payments and account recovery. See are game CAPTCHAs secure.

Where reCAPTCHA is a good fit

reCAPTCHA is a strong fit if you already run on Google Cloud, need iOS and Android SDKs (listed on all three tiers), or want a policy engine. Premium limits the policy engine to 3 rules and Enterprise gives the full engine. It also sits behind a very large number of existing form plugins, so a drop-in swap is often one settings page.

It is also the lowest-effort choice when your volume is small and your visitors are used to it. If you never exceed 10,000 assessments a month and your counsel is comfortable with the cookie, the free tier does the job.

Switching from reCAPTCHA

On WordPress, install the CaptchaKit plugin, paste your site key and API key in Settings, and choose the forms. The full walkthrough is in how to replace reCAPTCHA on WordPress. On a custom site, add one script tag and a div, then change your server check to the /api/verify call in the docs.

A quick decision checklist

Choose reCAPTCHA if your traffic stays under 10,000 assessments a month, you already use Google Cloud, you need mobile SDKs, or your forms sit behind plugins that only support Google. Choose CaptchaKit if you want the challenge to be part of your design, want one price instead of a metered one, and want a privacy policy that rules out advertising and tracking cookies.

If you are unsure, run both on a low-risk form for a week. Count completed submissions and spam on each. Our conversion answer explains how to run that test fairly.

Questions

Is CaptchaKit a drop-in replacement for reCAPTCHA?

On WordPress, yes in the sense that the plugin covers login, registration, comments and WooCommerce checkout. On custom sites you add a script tag and div and change your server check to POST /api/verify. The request and response shapes differ from Google's, so it is a small code change, not a settings flip.

Is reCAPTCHA still free?

Partly. Essentials is free up to 10,000 assessments per calendar month per organization. Past that, Essentials returns a 429 error, and Premium costs $8 flat for 10,001 to 100,000 assessments (checked October 2026). See is reCAPTCHA still free.

Does CaptchaKit set cookies?

Its privacy policy says no advertising or tracking cookies are used. A session cookie keeps CaptchaKit account holders logged in to their dashboard.

How long does the game take?

Each game lists an average play time. The range across the 18 games is 6 seconds for Tap in Order to 20 seconds for Maze Runner.

What if a visitor cannot play a game?

The widget has a "Can't play? Accessible check" link that switches to a screen-reader-friendly question and issues the same pass token.

How much does CaptchaKit cost?

The full pack and single games are pay what you want, one time, with lifetime access and unlimited domains. Business is $29 a month and adds analytics, webhooks, team seats and more.

Can I try the games before choosing?

Yes. Each game has a demo page, for example Connect 4 and Maze Runner.

Does CaptchaKit use Google services?

The privacy policy lists Stripe for payments, MongoDB Atlas for account and purchase records, and Vercel for hosting. It does not list Google as a processor of your visitors' data.