The difference
The comparison you can check for yourself.
No tick-box bingo, but the figures a decision actually turns on: where processing happens, what the visitor is asked to do, and who owns the infrastructure. All taken from the providers' public documentation, with a date and a source.
The decision
Three questions separate the providers
All four services compared here stop bots. The difference lies in what they ask of your visitors along the way, and who gets to see that data.
Where is the data processed?
If your visitors’ IP address leaves the EU, that is a transfer to a third country. How to classify it under data protection law is for you to clarify with your data protection advisor — we do not give a legal assessment.
What does the visitor see?
Picture puzzles cost conversions and lock out people with visual impairments. A method that normally needs no interaction at all does not have that drawback.
Who owns the infrastructure?
Whoever runs the servers themselves can say exactly where data is stored. With rented infrastructure, that commitment also depends on the upstream supplier.
The facts
Four providers, 10 sourced facts
Instead of ticks and crosses, you will find the actual values here, each with a public source. Where we have no reliable information, it says “n/a” — we don’t guess.
| Figure | CaptchaCore | reCAPTCHA | hCaptcha | FriendlyCaptcha |
|---|---|---|---|---|
| Provider and data processing | ||||
| Provider's registered office | Germany (SpeedIT Solutions UG) | USA (Google LLC); Google Ireland Limited in the EEA | USA (Intuition Machines, Inc.) | Germany (Friendly Captcha GmbH) |
| Place of processing | Germany | on servers worldwide, according to Google | in the USA, according to its privacy notice | according to the provider EU, USA and Asia; EU-only in higher plans |
| Transfer to third countries | none during verification | possible (worldwide servers) | yes, based on standard contractual clauses | depending on the plan |
| Cookies set by the widget | none | yes, _GRECAPTCHA for risk analysis | yes, technical cookies (incl. load balancing, session) | none, according to the provider |
| Data processing agreement | electronically in the customer account | n/a | Data Processing Addendum to the terms of service | n/a |
| What your visitors experience | ||||
| picture puzzles possible | no | yes, depending on the version | yes | no |
| Interaction in the normal case | none | depending on the version, none (v3) to a click (v2) | Click; passive mode in paid plans | none |
| Technology and price | ||||
| Proof of Work | yes, SHA-256 | n/a | n/a | yes |
| Reasoning behind the decision | Reason codes in every response | Reason codes once a billing account is added | Score reasons in Enterprise | Risk signals in dashboard and API |
| Pricing model | free for private use, net plans for business | free up to 10,000 assessments a month, paid above that | free basic tier, Pro and Enterprise paid | free for non-commercial use, otherwise from €9 a month |
About these figures
On our own row: challenge, risk engine and database run exclusively in Germany. If a customer embeds the global rather than the European endpoint for the widget file, that file is delivered worldwide. This affects only the loading of the script, not the verification.
As of September 2026. Information on other providers comes from their public documentation, not from our own measurements. We do not give legal assessments — whether a service requires consent on your website is for you to assess with your data protection advisor. If any information is outdated or wrong, let us know and we will correct it.
Sources (9)
- Google · Privacy policy (servers, EEA controller)
- reCAPTCHA · FAQ (_GRECAPTCHA cookie)
- reCAPTCHA · Interpreting assessments (reason codes)
- reCAPTCHA · Tier comparison (pricing)
- hCaptcha · Privacy notice (provider, cookies, processing, DPA)
- hCaptcha · Pricing (plans, passive mode)
- hCaptcha · Enterprise overview (score reasons)
- FriendlyCaptcha · Homepage (data centres, cookies, plans, risk signals)
- FriendlyCaptcha · Imprint (company, registered office)
One by one
What the others do well
A comparison in which the competition only looks bad is no comparison. So for each provider, first the strength and then what to look out for — both based on the facts in the table.
Google reCAPTCHA
The market leader
Strength
Widely used and documented everywhere: almost every CMS supports it. It is free up to 10,000 assessments a month, and once a billing account is added the response includes reason codes.
What to look out for
According to its own privacy policy, Google processes data on servers worldwide, and it sets the _GRECAPTCHA cookie for risk analysis. Depending on the version, suspicious visitors see an image puzzle.
hCaptcha
The alternative with a paid model
Strength
The integration resembles reCAPTCHA, so switching is quick. There is a free basic tier, a passive mode in the paid plans and score reasons in Enterprise.
What to look out for
The provider is based in the USA and, according to its privacy notice, processes data there on the basis of standard contractual clauses. The widget sets technical cookies, and image puzzles appear when a visitor looks suspicious.
FriendlyCaptcha
The closest relative
Strength
A German provider, proof of work instead of image puzzles, no cookies according to the provider, free for non-commercial use, and risk signals in the dashboard and API. Of all the services compared here, this is the approach closest to ours.
What to look out for
According to the provider, its data centres are in the EU, the USA and Asia; EU-only processing is available in higher plans. With us, verification runs in Germany in every package, and the data processing agreement can be concluded directly in your account.
Staying honest
When another provider is the better fit
You need operation without JavaScript
Proof of work and behavioural analysis require JavaScript. If a relevant share of your users browse without it, you need server-side protection instead, such as a honeypot or a check at firewall level.
You want exactly one account for everything
If you want to bundle your CAPTCHA together with CDN, WAF and DNS at a single provider, you are better served by a platform that delivers all of it. We do one thing.
You operate under US contract law
If your group governs data processing exclusively under US law and a German contracting party means extra effort, a US provider is simply the shorter route for you.
Switching
Switching in three steps
Changing your CAPTCHA is not a project, it is an afternoon. You need no downtime and can run both in parallel until you are satisfied.
Create site
Create a site with your domain in your account and copy the key. That takes a minute and costs nothing during the trial.
Switch the forms over
On WordPress, WoltLab, Symfony or Laravel a plugin or package handles it. Otherwise it is two lines in the form and one line on the server for the check.
Remove the old service
Only once verifications run cleanly do the old script and its paragraph in the privacy policy go. We supply a ready-made passage for the new one.
Best compared for yourself
The live demo shows the check from the visitor's side, including a simulated bot attack. After that you will know what this table is actually talking about.
Permanently free for private websites · Processing in Germany · Data processing agreement in your account