Home

/

Glossary

/

Browser

/

reCAPTCHA

Browser

6 min read

Also: Google reCAPTCHA, reCAPTCHA v2, reCAPTCHA v3, reCAPTCHA Enterprise, I'm not a robot, g-recaptcha-response, No CAPTCHA reCAPTCHA, recaptcha test keys

reCAPTCHA

Quick answer

reCAPTCHA is Google's bot check: v2 shows the "I'm not a robot" checkbox or image grids, while v3 runs invisibly and returns a score from 0.0 (likely bot) to 1.0 (likely human). Each token is valid for two minutes and can be verified once; to see how it compares with the alternatives, read what a CAPTCHA challenge is.

reCAPTCHA is Google's bot-detection service: v2 shows the 'I'm not a robot' checkbox or an invisible check that can escalate to image puzzles, while v3 returns a 0.0-1.0 risk score with no challenge. Sites verify its token server-side.

Anti-bot system
Official site ↗

Last verified

What people do with reCAPTCHA

Key facts

OwnerGoogle (acquired 2009; originated at Carnegie Mellon University)
Versionsv2 checkbox and v2 invisible (2014), v3 score-based (2018), reCAPTCHA Enterprise; v1 retired 2018
v3 score range0.0 (likely bot) to 1.0 (likely human); threshold chosen by the site
Token lifetimeValid for two minutes and can be verified only once
PricingGoogle Cloud product: first 10,000 assessments per month free, billing account required above that
Server-side checkgoogle.com/recaptcha/api/siteverify (classic) or the Enterprise createAssessment API

What is reCAPTCHA?

reCAPTCHA is Google's bot-detection service and the most widely recognized CAPTCHA on the web. It is the "I'm not a robot" checkbox, the grid of buses and crosswalks, and, in its newer forms, an invisible check that never shows anything at all. Site owners add it to logins, sign-ups, comment forms and checkouts to slow down spam, credential stuffing and fake account creation.

reCAPTCHA started as a Carnegie Mellon University research project that used distorted words from scanned books. Google acquired it in 2009. Since then there have been three generations:

  • reCAPTCHA v1 (distorted text): retired in 2018.
  • reCAPTCHA v2, announced in December 2014 as "No CAPTCHA reCAPTCHA". It comes in two forms: the checkbox ("I'm not a robot", which escalates to an image grid when Google is unsure) and invisible (no checkbox; the check runs when the user clicks a button, and a challenge appears only if needed).
  • reCAPTCHA v3, released in 2018. It never shows a challenge. Instead it returns a score between 0.0 (very likely a bot) and 1.0 (very likely a good interaction) for each action, and the site decides what to do with it: allow, require extra verification, or block.

    • Google now also sells reCAPTCHA Enterprise, and has moved every reCAPTCHA key into Google Cloud (2025 to early 2026).

    How reCAPTCHA works

    Every version follows the same pattern:

  • The page loads Google's script with a site key.
  • In the browser, reCAPTCHA collects signals about the session (how the page was interacted with, browser and device characteristics, Google's own risk data, and for v2 the answer to any image challenge) and produces a response token. On a form this lands in a hidden field named g-recaptcha-response.
  • The site's server sends that token and its secret key to Google's verify endpoint (https://www.google.com/recaptcha/api/siteverify for classic keys, or the reCAPTCHA Enterprise createAssessment API).
  • Google returns whether the token is valid, the hostname and action it was issued for, and for v3 the score.

    • Google's documentation states that each response token is valid for two minutes and can be verified only once, to prevent replay. That rule explains a lot of "reCAPTCHA failed" reports from slow forms and from scripts that reuse a token.

    For v3, Google does not mandate a single threshold. Many integrations start at 0.5 and tune from there, using the score per action (login, checkout, comment) rather than a site-wide cut-off.

    reCAPTCHA moves to Google Cloud

    In 2025 Google began migrating all "classic" reCAPTCHA keys (the ones created at google.com/recaptcha/admin) into Google Cloud projects, with automated migration of remaining keys scheduled to finish in Q1 2026. After migration, reCAPTCHA is billed as a Google Cloud product: the first 10,000 assessments per month are free, and above that a Cloud billing account is required. Google's billing page has the current tiers. If you maintain a site and your reCAPTCHA started erroring after a quota was hit, this migration is usually why.

    Why reCAPTCHA appears in automation

    For anyone automating a browser, reCAPTCHA shows up in a few predictable ways:

  • The checkbox escalates to image challenges every time. reCAPTCHA weighs session history heavily. A fresh browser profile with no cookies, a datacenter IP and automation traits (see headless Chrome) looks risky, so the grid appears more often.
  • v3 silently blocks you. There is nothing to click. The site just receives a low score and rejects the login or shows an error, which is confusing because no CAPTCHA ever appears on screen.
  • "reCAPTCHA token expired" or "timeout-or-duplicate". The token was older than two minutes, or the same token was submitted twice.
  • A plain HTTP client cannot produce a token. Tools that only download HTML, such as Google Sheets IMPORTXML or a requests script, never run the JavaScript that creates one.

    • Responsible ways to handle it

    A reCAPTCHA on a form is the site owner saying they do not want automated submissions there. Before automating past it, check the site's terms and whether there is an official API, export or partner program, which is almost always the better route. Keep request volumes modest (see rate limiting) and follow our web scraping best practices. For accounts you own, a human-in-the-loop step for the verification is usually enough, because a well-designed automation only meets the CAPTCHA occasionally.

    reCAPTCHA and Autonoly

    Autonoly's agent drives a real headed Chromium browser. When CAPTCHA solving is enabled, it can solve reCAPTCHA v2 challenges (checkbox and image grid) that appear during a run. reCAPTCHA v3 has no challenge to solve: if a site scores the session low and refuses it, the agent cannot change that. When it meets a check it cannot complete, the agent hands you the browser through live browser control so you can finish it yourself. Autonoly does not use proxies or rotate IP addresses.

    Why It Matters

    reCAPTCHA protects a huge share of web forms, so it is the CAPTCHA automation builders meet most often. Knowing the difference between v2 challenges and v3 scores, and the two-minute single-use token, explains most failed runs and points to the right fix: an API, a slower and more realistic flow, or a human step.

    How Autonoly Solves It

    When CAPTCHA solving is enabled, Autonoly's agent can solve reCAPTCHA v2 checkbox and image challenges in its real Chromium browser. For v3 low scores and anything else it cannot complete, it hands you the live browser to finish the step. It does not use proxies or IP rotation.

    Learn more

    Examples

    • A job-application run hits a reCAPTCHA v2 checkbox on the submit step; with CAPTCHA solving enabled the agent completes it and submits the form

    • A script's logins keep failing with no visible CAPTCHA because the site uses reCAPTCHA v3 and is rejecting low scores

    • A site owner sees reCAPTCHA errors after their classic key was migrated into a Google Cloud project and exceeded the free monthly assessments

    Frequently Asked Questions

    reCAPTCHA v2 shows a challenge: the 'I'm not a robot' checkbox, or an invisible check that can escalate to an image grid. reCAPTCHA v3 never shows anything; it returns a score from 0.0 to 1.0 for each action and leaves it to the site to allow, challenge or block.

    Google's documentation says a reCAPTCHA response token is valid for two minutes and can be verified only once. Submitting a form slowly, or reusing a token, produces 'timeout-or-duplicate' style failures.

    Partly. reCAPTCHA is now billed as a Google Cloud product. The first 10,000 assessments per month are free; above that you need a Google Cloud billing account. Classic keys were migrated into Cloud projects, with the automated migration scheduled to finish in Q1 2026.

    Google does not set one universal threshold. Many sites start at 0.5 and adjust per action after looking at real traffic, for example accepting lower scores on a newsletter sign-up than on a login or checkout.

    reCAPTCHA weighs session history and environment. A fresh profile with no cookies, automation traits from headless or DevTools-driven browsers, and datacenter IP addresses all look riskier, so the checkbox escalates to image grids more often.

    It can solve reCAPTCHA v2 when CAPTCHA solving is enabled. reCAPTCHA v3 has no challenge to solve, so a low score is not something the agent can change. When it cannot complete a check, the agent hands you the live browser.

    Yes, for reCAPTCHA v2. Google's FAQ publishes a test site key (6LeIxAcTAAAAAJcZVRqyHh71UMIEGQQ_MXjiZKhI) and secret key (6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe). With them every verification passes and the widget shows a warning that it is for testing only. Use them only in automated tests and development, never in production. Keys are tied to their type, so a v2 checkbox key will not work for v3 or invisible reCAPTCHA.

    Further reading

    Templates
    Blog Posts
    ← Rate LimitingRetry Logic →

    Related terms, automations and guides

    Where this concept shows up in practice.

    DefinitionCAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response mechanism designed to distinguish human users from automated bots on websites.DefinitionhCaptchahCaptcha is a privacy-focused CAPTCHA and bot-detection service by Intuition Machines. It shows image challenges or runs passively, issues a token, and lets the site verify it server-side through its siteverify API.DefinitionCloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, issues a single-use token, and lets the site verify that token server-side through the Siteverify API.DefinitionHeadless ChromeHeadless Chrome is Google Chrome running without a visible window. It renders pages and runs JavaScript like normal Chrome and is controlled by code, which makes it the standard engine for automated testing, scraping, screenshots and PDF generation.DefinitionRate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given time window, preventing abuse and ensuring fair resource distribution.DefinitionIMPORTXMLIMPORTXML is a Google Sheets function that fetches a URL from Google's servers and returns whatever an XPath query selects from the page, such as titles, prices or links. It reads only the raw HTML, so it cannot see content that JavaScript adds after the page loads.GuideAutonoly vs Bardeen: AI Browser Automation Compared (2026)An honest, in-depth comparison of Autonoly and Bardeen for AI browser automation. We compare architecture, features, pricing, and use cases to help you choose the right tool for your automation needs.GuideWeb Scraping Best Practices: Avoiding Blocks, Bans, and Legal IssuesA comprehensive guide to web scraping best practices. Learn how to avoid IP blocks, deal with CAPTCHAs and anti-bot systems, respect legal boundaries, and where AI browser agents help (and where they don't).

    Stop reading about automation.

    Start automating.

    Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.

    See Features