Your existing integration already fits.

We answer on reCAPTCHA's and hCaptcha's own script paths and return their verify shapes, so the markup and the backend call you already have keep working.

Get started free Read the docs

How it works

The same globals and the same fields

A reCAPTCHA integration keeps its g-recaptcha-response field; an hCaptcha one keeps h-captcha-response. Your form and your request handler are untouched.

The same verify response

Our endpoints return {success, challenge_ts, hostname, error-codes}, so most libraries need no change beyond the URL.

Or use the native API

If you would rather not run through a shim, there is a first-party REST endpoint and server SDKs for Go, Node, PHP and Python.

What that means concretely

Each of these is a statement about how the product behaves, not a description of how we feel about it.

From reCAPTCHA: two URL changes.

From hCaptcha: two URL changes.

From Turnstile: three - there is no Turnstile shim, so the field name moves too.

Other features

Privacy and GDPR Risk scoring Proof-of-work Accessible challenge No Google dependency Per-site dashboard

Drop-in migration in PrivCaptcha: common questions

What drop-in migration actually does, and where it stops.

Coming from reCAPTCHA or hCaptcha, no - we answer on a compatible verify shape, so the script tag and the sitekey are the change. Coming from Turnstile there is one extra edit, because the response field is named differently; that page spells it out.

For reCAPTCHA and hCaptcha, nothing we know of - the globals and the response field keep their names. The honest exceptions are documented per provider rather than buried: Turnstile's field name, and verify-response fields like action and cdata that we do not return.

Yes, and it is the sensible way to do it. Each site gets its own key pair and domain allowlist, so one form can run on PrivCaptcha while the rest of the site stays where it is.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

Change two lines. Keep the rest.

10,000 verifications a month are free, and the integration is the one you already have.

Get started free See the migration guide