What a captcha costs your visitors

Six products in eight set-ups on the same sign-up page, in the same browser, on the same day. What each one downloads, who it talks to, and how long until a pass.

Side by side

Medians of three runs, 4 November 2026. The letter after each product points to the key it ran with; read those first.

Product	Requests	On the wire	Origins	Cookies	Ready	Pass	Pass, slow connection
Cloudflare Turnstile, visible ^a	3	237 KB	1	0	196 ms	1,966 ms	4,891 ms
Cloudflare Turnstile, invisible ^a	3	241 KB	1	0	183 ms	1,965 ms	4,877 ms
Google reCAPTCHA v2, invisible ^b	19	460 KB	3	1	522 ms	1,259 ms	8,205 ms
Google reCAPTCHA v3 ^b	19	460 KB	3	1	512 ms	1,234 ms	8,213 ms
hCaptcha, invisible ^c	6	328 KB	6	2	233 ms	656 ms	4,906 ms
Friendly Captcha v2 ^d	4	82 KB	2	0	185 ms	n/a	n/a
ALTCHA, test mode ^e	1	27 KB	1	0	223 ms	724 ms	1,385 ms
OTCaptcha, loader 1.4.0 ^f	3	15 KB	1	0	269 ms	443 ms	2,190 ms

a Documented test key: always passes. A production key may add an interactive challenge.
b Documented test key: always passes. No v3 test key exists, so v3 was loaded with the v2 key.
c Documented publisher test key: never challenges.
d No public test key exists, so only the download and the widget start are shown.
e Built-in test mode: the challenge is made in the browser and no server is contacted.
f Live service with a test site key: a real challenge, real background work and a real server check.

In one line: the smallest download of the set, one origin, no cookies, and the fastest to a pass with a real server behind it.

How it was measured

The page: A plain sign-up form with one field and one button. Each product's documented script and documented public test key were added after the page had loaded, so the clock starts when the tag is added and the figures are the captcha's own.
Runs: Three per product and condition, each in a fresh browser profile with an empty cache and no cookies. The tables show the median.
Ready: The product's own ready callback: the moment a page could start a check.
Pass: The moment a token exists that the page could send to its server. For OTCaptcha that includes the background work and two round trips to a live service.
Slow connection: The same run on the browser's Slow 4G profile, with a half-second round trip, 180 KB a second down and the processor slowed four times.
On the wire: Compressed bytes, body plus response headers, to every origin other than the page itself.
Keys: Public test keys pass without a challenge by design. For every product that ran with one, the pass time is the fastest that product can be: a production key can only add time, and may add a challenge. The other products' figures are from their public scripts as served that day and may change.

What this page does not say

It does not say who stops more bots. Nobody can measure that from outside. It is one browser from one place on one day; a visitor far from any vendor's nearest server pays more on every row, and phones were not measured. Names are product names only, with no claim about the companies behind them.

Numbers from the research

Quoted, with the source. These are not our measurements.

3 to 32 seconds

What a human spends on a visible captcha: 3 to 5 seconds on a click, 15 to 32 seconds on an image or puzzle, passing 50 to 85 percent of the time. Bots passed the same captchas 85 to 100 percent of the time.

An Empirical Study and Evaluation of Modern CAPTCHAs, USENIX Security 2023, 1,400 participants. arXiv 2307.12108.

98 percent to 10 percent

A vision model solved clean slider puzzles 98 percent of the time. When the server checked the drag path instead of the end position, the best model fell to 10 percent.

HLL: Can Agents Cross Humanity’s Last Line of Verification?, June 2026. arXiv 2606.02449.

Under 3 euros per 1,000

What a human solve of any mainstream captcha costs an attacker on a solver marketplace, invisible products included. No product makes automation unaffordable; the defensible claims are about the cost to the visitor and what the risk layer sees.

A public solver price list, read November 2026.

See it on your own form

The demo runs the three checks in your browser. The harness and the raw results are available on request; run them against your own site key and tell us if yours differ.

Try the demo Join the waitlist