reCAPTCHA Test: Check Your reCAPTCHA Score Online
Run a free reCAPTCHA test in your browser: the v2 checkbox challenge and the v3 score check. No setup, no keys, no sign-up. See exactly what Google returns for your current session: score, action, hostname, challenge timestamp, IP address, User Agent, and the full server verification result.
- Free online reCAPTCHA test - no keys required
- reCAPTCHA v2 checkbox test (the "I'm not a robot" challenge)
- Live reCAPTCHA v3 score result
- Action, hostname, and challenge timestamp
- IP address, User Agent, and backend response
reCAPTCHA v2 Checkbox Test
Low score or a challenge every time? Your visitors get them too.
A reCAPTCHA score only tells you how Google rates one session. It does not stop spam by itself, and every challenge you show costs you real submissions - contact forms, registrations and orders included.
CleanTalk filters spam in the cloud, before the submission reaches your site: no checkbox, no image puzzle, no score to tune. Bots are stopped by IP and email reputation and by how the session behaves.
See the no-CAPTCHA alternativeResult Details
Previous Checks
- No previous checks yet.
What is a reCAPTCHA test?
A reCAPTCHA test helps you check whether Google reCAPTCHA is working and what verification response it returns for your current browser session.
Why is the reCAPTCHA score always 0.9?
This often happens in test or low-traffic environments where reCAPTCHA has limited behavioral data to evaluate. We have researched this issue in detail here.
Can I trust localhost reCAPTCHA test results?
They are useful for checking the integration, but they are not always representative of real production behavior.
What should the backend return?
The endpoint should accept a token and return JSON with fields like success, score, action, hostname, challenge_ts, error-codes, remote_ip, user_agent.
Why Test Both v2 and v3 on One Page
The main purpose of this page is to test how reCAPTCHA v3 evaluates a request in the background and what score it returns. In some cases, however, it is also useful to compare that result with a separate checkbox-based verification flow.
The optional visual checkbox test helps you confirm that the widget loads correctly, that the token is passed to the backend, and that the returned validation details are visible on the same page.
In practice, this gives you two complementary checks in one place: a reCAPTCHA v3 score-based test and an additional visual checkbox comparison flow. This is useful for debugging, QA, and implementation review.
reCAPTCHA v2 test (checkbox challenge)
reCAPTCHA v2 is the version people usually mean when they say "the captcha test" - the "I'm not a robot" checkbox and the image challenge that follows it. Use the checkbox test above to see how the v2 flow behaves in your browser: whether you get through with one click, whether Google asks for an image challenge, and what the verification response looks like on the server side.
The difference in one line: v2 asks the visitor to prove something, v3 scores the session silently. Testing both on the same page shows you what your visitors actually experience.
| What the visitor does | v2: ticks a checkbox, sometimes solves an image challenge | v3: nothing, the check is invisible |
| What you get back | v2: pass or fail for that challenge | v3: a score from 0.0 to 1.0 |
| Friction | v2: visible, costs you completed forms | v3: none for the visitor |
| Best used for | v2: a single high-risk form | v3: site-wide risk signals |
Neither version filters spam by itself: v2 stops the sessions that cannot solve a challenge, v3 hands you a number and leaves the decision to you. Both still let through spam sent by people, and both are bypassed by paid solving services.
Google reCAPTCHA test keys
Google publishes an official test key pair for development. With those keys the widget always passes and reCAPTCHA v3 always returns a score of 0.9, no matter who is on the page. That is by design: the test keys are meant for wiring up the integration, not for measuring risk.
This is the most common reason behind the question "why is my score always 0.9". If you are testing with the official test keys, or on a site with very little real traffic, the number tells you nothing about your visitors. Use your own keys on a real domain, then compare the response fields returned below.
The test on this page runs against live keys, so the score you see reflects your actual browser session.
What Do reCAPTCHA Scores Mean?
reCAPTCHA v3 returns a score from 0.0 to 1.0 for each verified request. In general, a score closer to 1.0 suggests lower-risk behavior, while a score closer to 0.0 suggests higher-risk or more suspicious activity.
The important thing is not to treat one number as a universal verdict. A reCAPTCHA score should be interpreted in the context of your website, your protected action, and your traffic patterns. The same visitor can receive different scores on different sites or even on different actions within the same site.
| 0.9–1.0 — Very low risk This range usually looks like normal human activity. On many websites, requests in this range are considered trustworthy enough to proceed without extra friction, although final handling still depends on the action being protected. | 0.7–0.8 — Low risk These requests still look mostly legitimate, but some teams prefer to monitor them more closely for sensitive actions such as login, registration, checkout, or password reset. |
| 0.5–0.6 — Medium or uncertain risk This is often the range where interpretation becomes less obvious. It may be reasonable to combine the score with other signals such as rate limits, form behavior, IP reputation, user history, or additional verification steps before making a decision. | 0.3–0.4 — Elevated risk Requests in this range may deserve extra caution. Many sites choose to add friction here, such as email confirmation, moderation, approval flow, step-up verification, or temporary rate limiting. |
| 0.0–0.2 — High risk This range is usually treated as suspicious. Depending on the site, traffic in this range may be blocked, challenged, sent to moderation, or marked for deeper review before the action is allowed to continue. | Important context These ranges are practical interpretation guidelines, not fixed universal rules. A score can look strong in one environment and still be misleading in another, especially on new sites, staging environments, or pages with limited real traffic and behavioral diversity. |
How to Use reCAPTCHA Scores in Practice
- Use the score as a risk signal, not as a standalone security decision.
- Review the score together with action, hostname, challenge timestamp, request volume, and your own business logic.
- Avoid assuming that one threshold will work equally well for every action. A login form, checkout flow, comment form, and registration page may need different handling.
- If you keep seeing repeated high scores in a test environment, that does not automatically mean the setup will behave the same way in production.
- The safest approach is to observe score patterns over time and tune your thresholds gradually instead of making hard decisions from a single test.
Quick Summary
0.9–1.0 — very low risk
0.7–0.8 — low risk
0.5–0.6 — medium or uncertain risk
0.3–0.4 — elevated risk
0.0–0.2 — high risk
Free reCAPTCHA Test and v3 Score CheckerReview how reCAPTCHA v3 behaves in your environment and learn what the returned score actually means. Below on this page, you can run a live test and inspect the validation details returned by the server. Use the button below to jump to the test section. Live score Optional checkbox test Action validated Hostname verified Backend response Free tool The live test is available further down the page, together with score interpretation, an optional checkbox-based comparison, and validation details. | Validation Guide Score Optional checkbox test Action Hostname Timestamp Error Codes |
Why This Page Exists
- reCAPTCHA v3 can look simple on the surface: a token is generated, the request is verified, and a score is returned. In practice, however, the score alone often does not explain whether your setup is actually reliable.
- This page is designed to help you understand what happens behind the score. It explains which response fields matter, why test environments can be misleading, and how to review the result more carefully before using it in production decisions.
- Further down this page, you can run a live reCAPTCHA v3 score check, compare it with an optional checkbox-based visual check, and inspect the validation details returned by the server.
How This reCAPTCHA v3 Score Test Works
| The goal of this page is not just to show a score, but to help you review the full validation flow in a practical way.
This process takes only a few seconds and gives you a much clearer view of how reCAPTCHA v3 behaves in your current environment. | 4-Step Flow 1. Generate token 2. Verify on backend 3. Return fields 4. Interpret response |
Go to the Live Test
- If you want to see how your current environment responds, use the live test below. It will generate a fresh token and show the validation details returned by the server.
- You can also run the optional checkbox test to compare reCAPTCHA v3 score-based validation with a separate challenge-based verification flow on the same page.
- This is especially useful if you are testing a local setup, reviewing staging behavior, or trying to understand why the score remains too stable across repeated checks.
How to Read the Validation Response
The live test below returns technical validation data from the verification request. This section explains how to interpret the returned fields, including score, success, action, hostname, challenge timestamp, and possible error codes.
Score
The score is a risk signal, not a final verdict. A higher score usually suggests lower-risk behavior, while a lower score suggests more suspicious activity. Still, a high score in a low-traffic or artificial environment does not always mean the result is truly reliable.
Success
This field shows whether the verification request completed successfully. A successful response confirms that the token was accepted and processed, but it does not automatically mean your overall setup is ready for production decisions.
Action
The returned action should match the action requested by the frontend. If it does not match, your integration may need to be reviewed.
Hostname
The hostname should correspond to the environment where the token was generated. If it does not, the token may not be valid for your current setup.
Challenge Timestamp
This shows when the token was created. A fresh timestamp helps confirm that the request is current and properly generated.
Error Codes
If any error codes appear, they can help identify invalid tokens, configuration issues, or verification problems more quickly.
Why This Page Is Useful
| Live technical validation | Focused on practical debugging | Useful across environments |
| Review the actual response fields returned by the verification request instead of relying on assumptions. | Check whether score, action, hostname, timestamps, and the optional checkbox-based verification behave as expected in your current environment. | Compare local, staging, and production-like behavior more clearly before applying score-based decisions. |
Why a Full Validation Check Is Better Than Looking at Score AloneA reCAPTCHA v3 score by itself does not always explain whether your setup is truly reliable. A technically correct response may still be misleading if the environment has too little traffic, if the action is inconsistent, or if the hostname does not match the expected context. That is why this page focuses on more than the score. It helps you review the full validation response so you can better understand whether the result is technically correct and practically useful. The added optional checkbox test makes this comparison clearer, especially when your team wants to compare background score-based evaluation with a separate visible challenge flow on the same page. |
6 Situations This Page Helps You Investigate
1. The score always stays the sameIf every test returns nearly the same result, your environment may not provide enough useful signal for meaningful scoring. | 2. You only tested on localhost or stagingThe integration may work technically, but the returned score may not reflect real production behavior. |
3. You do not verify the token on the backendFrontend integration alone is not enough. Real validation must happen server-side. | 4. The action may not matchIf the returned action does not match the expected one, your implementation may need to be reviewed. |
5. You never inspect hostname or timestampWithout checking these fields, it is harder to know whether the token is really valid for the current environment. | 6. You want to compare score-based evaluation with a separate checkbox challengeThe page helps compare reCAPTCHA v3 background scoring with an optional checkbox-based visual verification flow in one place. |
Process of Using This Score Test
| 1. Open the page in the environment you want to test | 2. Run a live verification check | 3. Review the returned fields | 4. Compare the result with your expected setup |
| Use the page in local, staging, or production-like conditions depending on what behavior you want to inspect. | Generate a fresh token or run the optional checkbox test and send it to the backend for verification. | Inspect score, success, action, hostname, timestamp, request details, and any returned error codes. | Use the returned response to decide whether your current integration is technically correct and operationally useful. |
The whole process takes only a few seconds and helps you review reCAPTCHA behavior more carefully before making production decisions.
Validation Review Checklist
| Use the result returned by the test as a lightweight validation report for your current reCAPTCHA setup.
|
|
Who This Page Is For
| Developers Use it to review implementation details and verify the backend flow. | QA and technical teams Use it to compare behavior across environments and identify inconsistencies. | Site owners and product teams Use it to understand whether score-based decisions are ready for real-world use. |
I Have Questions…
Why do I always get a 0.9 score?
This often happens when the environment has too little real traffic or behavioral diversity for the model to produce a more nuanced score.
Why do I keep getting the CAPTCHA test?
Repeated challenges usually mean the session looks risky to Google: a shared or data-center IP address, a VPN or proxy, an unusual user agent, blocked cookies, or fast, repetitive behaviour on the page. Nothing is necessarily wrong with you - the score is a guess based on signals. It is also why many site owners move away from challenges: spam can be filtered server-side without showing anything to the visitor at all.
Is it possible to fail a CAPTCHA test?
Yes. With v2 you fail by not solving the challenge, or by solving it too slowly or too perfectly. With v3 there is no pass or fail - you get a low score, and the site decides what to do with it: block, hold for review, or ask for an extra step.
How to trigger reCAPTCHA for testing?
Open the test in a private window, switch browsers, turn on a VPN, or clear cookies before running it - all of these lower the trust signals for the session and make challenges more likely. Submitting the test several times in a row has the same effect.
Can I trust results from localhost or staging?
They are useful for checking integration, but they may not reflect real production scoring behavior.
What should I check besides the score?
You should always review success, action, hostname, challenge timestamp, and any returned error codes.
Does a high score guarantee safe traffic?
No. A score is only one signal and should not be treated as a complete security decision by itself.
Can I use this page without changing my existing test logic?
Yes. This page can wrap your existing test block and add explanation, interpretation, and context around it.
What is the optional visual test for?
The optional visual checkbox test helps you check how a separate challenge-based verification flow behaves in your current environment. It is useful for confirming that the widget loads correctly, the token is passed to the backend, and the returned validation details are shown together with the score-based test results.
Run the Test and Review the Full Response
Low score or a challenge every time? Your visitors get them too.
A reCAPTCHA score only tells you how Google rates one session. It does not stop spam by itself, and every challenge you show costs you real submissions - contact forms, registrations and orders included.
CleanTalk filters spam in the cloud, before the submission reaches your site: no checkbox, no image puzzle, no score to tune. Bots are stopped by IP and email reputation and by how the session behaves.
See the no-CAPTCHA alternativeGenerate a live token, verify it on the server, inspect the returned fields, and compare the result with an optional checkbox-based verification flow before relying on score-based decisions in production.
