I've seen lots of SO posts and other articles on the internet about the differences between Google's ReCAPTCHA v2 and v3, but I'm not sure which one I should use. I'm looking to protect my website's sign up page (React frontend + Node.js backend). Which version of ReCAPTCHA should I choose? I feel like I've seen v2 in more places than v3, but then again, v3 is hidden... What are the security benefits of both versions like? Are websites less secure or considered "older" if they use v2?

Edit: The reason I ask, instead of just going with the newer one, is because I see a lot of sites still using v2.


v3 allows you to verify if an interaction is legitimate with no user interaction. It is a pure JavaScript that compiles a score, giving you the ability to take other actions like requiring additional factors of authentication.

v2 comes in 2 versions

"I'm not a robot" Checkbox - requires the user to click a checkbox indicating the user is not a robot. This will either pass the user immediately (with No CAPTCHA) or challenge them to validate whether or not they are human.

The invisible reCAPTCHA badge - does not require the user to click on a checkbox, instead it is invoked directly when the user clicks on an existing button on your site or can be invoked via a JavaScript API call. The integration requires a JavaScript callback when reCAPTCHA verification is complete. By default only the most suspicious traffic will be prompted to solve a captcha.

Which one is best for you will be depending on the nature of your website. For a general use site, I'd certainly use v3 as it minimizes the interruption of users with challenges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.