Availablelive test

reCAPTCHA v2

The "I'm not a robot" checkbox. Most visitors click once; the ones Google is unsure about get a grid of traffic lights, crosswalks or buses. An invisible mode runs the same check when the form is submitted.

Vendor

Google

Launched

December 2014 ("No CAPTCHA reCAPTCHA"); invisible mode March 2017

Type

Checkbox + image puzzle; invisible variant

Can I install it?

Yes, with a free key from the reCAPTCHA admin console

Price

Free up to 10,000 assessments per month, then paid

Replace with

CleanTalk (invisible, checks the sender too) or Turnstile (browser check only)

Live widget

Google test key

Tick the box. On the test key Google always passes and shows "This reCAPTCHA is for testing purposes only".

Time it in the full test

What the visitor goes through

Checkbox mode. One click for most people. If Google's risk analysis is unsure, an image grid appears; a wrong grid means another grid.
Invisible mode. Nothing is shown until the form is submitted; then the same risk analysis runs and may still pop a puzzle.
Who gets the puzzles. VPN users, privacy browsers, people not signed in to a Google account, shared office IPs. The visitor cannot do anything about it.

How it gets bypassed

Solver services sell reCAPTCHA v2 answers by the thousand; a bot posts the puzzle, a human or a model solves it in seconds. Every major solver lists v2 as supported.
Research has repeatedly shown automated solving of the image grids with off-the-shelf vision models (Searles et al., USENIX Security 2023 measured bots outperforming humans on image CAPTCHAs).
Human spam is untouched: a person typing a sales pitch into your form passes the checkbox like any other visitor.

What it costs

Image challenges take 15 to 26 seconds with 71 to 85 percent human accuracy (Searles et al., 2023). The checkbox alone is a second or two, but you do not control who gets the grid.

Embed code

Replace the site key with your own from the reCAPTCHA admin console; the key below is Google's public test key and always passes.

<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<form method="post">
  ...
  <div class="g-recaptcha" data-sitekey="6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI"></div>
  <button type="submit">Send</button>
</form>
<!-- server: POST https://www.google.com/recaptcha/api/siteverify with secret + g-recaptcha-response -->

Same form, no checkbox. Same spam, blocked.

CleanTalk checks the sender in the cloud: email, IP, behaviour and text. Your visitor sees nothing and your form gets both bots and human spam filtered.

1,105,000+ websites protectedup to 99.97% accuracylive in 60 seconds7-day free trial, no card

Start 7-day free trial Run the full test

Sources: Google reCAPTCHA FAQ (test keys), reCAPTCHA developer guide (v2 checkbox, invisible), Google reCAPTCHA pricing (10,000 free assessments per month); Searles, Nakatsuka, Ozturk, Paverd, Tsudik, Enev, "An Empirical Study & Evaluation of Modern CAPTCHAs", USENIX Security 2023. Related: reCAPTCHA v3, hCaptcha, Turnstile, reCAPTCHA score test. CleanTalk is not affiliated with Google.