# Turnstile vs hCaptcha vs reCAPTCHA: speed and size tested We loaded all three captcha widgets 5 times each in Chrome with a cold cache: kilobytes transferred, requests, hosts, time to show and time to pass. Author: Formgong Published: 2026-10-16 Language: en Canonical: https://formgong.com/en/blog/turnstile-vs-hcaptcha-vs-recaptcha-speed/ On our tests Turnstile was the lightest: about 141 KB in 3 requests to one host, ready in about 0.3 s, and it passed with no click. hCaptcha moved about 310 KB in 6 requests to four hosts; reCAPTCHA v2 about 454 KB in 15 requests to three Google hosts and took about 1 s to show. All three needed well under a second after a click. ## The numbers Medians of 5 cold loads per widget on 16.10.2026, in Google Chrome 155 with a fresh browser profile for every run, so nothing came from the cache. Each widget sat in the same small form and used its vendor's published test site key. “Ready” is the time from opening the page until the widget's own frame finished loading. Ranges are min to max. Captcha widgets, 5 cold loads each WidgetTransferredRequestsHostsReadyClick to token Turnstile, auto-pass key141 KB (140–146)31287 ms (259–362)no click needed Turnstile, checkbox key142 KB (138–146)31316 ms (275–369)51 ms (5–66) hCaptcha310 KB (310–311)64515 ms (437–639)126 ms (110–153) reCAPTCHA v2454 KB (453–454)153951 ms (944–1014)267 ms (229–297) The hosts were challenges.cloudflare.com for Turnstile; js.hcaptcha.com, newassets.hcaptcha.com, api.hcaptcha.com and a subdomain of hcaptcha.com that changed on every run; and www.google.com, www.gstatic.com and fonts.gstatic.com for reCAPTCHA. With the auto-pass key, Turnstile's token arrived 1.79 s after the page opened (1.77–1.88) without a click. “Transferred” counts every request to the vendor's hosts, including what loads inside the widget's frame, until the token arrived plus three seconds. Of reCAPTCHA's 454 KB, 346 KB were JavaScript files; Turnstile's JavaScript files came to 28 KB. ## What the visitor has to do With the auto-pass test key, Turnstile showed a spinner and then “Success!” without any click, and the token arrived about 1.8 seconds after the page opened. That is what Turnstile's Managed mode does for most visitors: it runs its checks in the background and shows a checkbox only when it is unsure, which is what the second Turnstile row simulates. hCaptcha and reCAPTCHA v2 always showed a checkbox (“I am human”, “I'm not a robot”), and with their test keys one click was enough. With real keys both can follow the click with an image puzzle when they distrust the visitor. Test keys never do, so the click-to-token times above are the best case. All four widgets printed a red “for testing only” line, which is how you can spot a test key left on a live site. ## What these numbers cannot tell you - **Test keys skip the real risk checks.** A real Turnstile key may take longer to decide, and a real hCaptcha or reCAPTCHA key may show puzzles. What we measured is the loading cost, which does not depend on the key. - **One network.** All runs came from one laptop on a home connection. Absolute times will differ for your visitors; the order and the byte counts should not change much. - **Vendors change their scripts.** These are the files they served on 16.10.2026. - **reCAPTCHA v3 is not in the table.** It has no published test key, so we could not measure it the same way. ## What we would pick for a contact form On loading cost alone Turnstile wins clearly: a third of reCAPTCHA's bytes, a fifth of its requests, one host instead of three, and no click for most visitors. hCaptcha sits in the middle. If you would rather not show any widget, a [honeypot field](/en/blog/honeypot-form-field/) and server-side checks stop a lot of form spam on their own; see [contact form spam without a captcha](/en/blog/contact-form-spam-without-captcha/). Plans, limits and privacy terms of the three services are compared in [Turnstile vs reCAPTCHA vs hCaptcha](/en/blog/turnstile-vs-recaptcha-vs-hcaptcha/), and the Turnstile error codes in [our Turnstile errors guide](/en/blog/turnstile-timeout-or-duplicate/). ## Turnstile with Formgong [Formgong](/en/) verifies Cloudflare Turnstile on its server for each submission to `https://formgong.com/submit`. Turn on **Require Cloudflare Turnstile** in the form settings, add your site key and secret, and put the widget in the form. See the [HTML guide](/en/docs/html/). ## Frequently asked questions ### Which captcha loads fastest, Turnstile, hCaptcha or reCAPTCHA? On our 5 cold loads in Chrome, Turnstile was ready in about 0.3 s, hCaptcha in about 0.5 s and reCAPTCHA v2 in about 1 s. ### How big is the reCAPTCHA script? Loading the reCAPTCHA v2 checkbox transferred about 454 KB in 15 requests on our test, 346 KB of it JavaScript. Turnstile transferred about 141 KB in 3 requests. ### Does Turnstile need a click? Usually not. In Managed mode it decides in the background and shows a checkbox only when unsure. With the auto-pass test key the token arrived about 1.8 s after page load with no click. ### Are captcha test keys a fair benchmark? For loading cost, yes: the same files load. For solving, no: test keys never show puzzles, so real visitors can take longer with hCaptcha and reCAPTCHA. ## Sources and documentation - [Cloudflare: Turnstile testing (test keys)](https://developers.cloudflare.com/turnstile/troubleshooting/testing/) - [hCaptcha: Developer guide (test keys)](https://docs.hcaptcha.com/#integration-testing-test-keys) - [Google: reCAPTCHA FAQ (test keys)](https://developers.google.com/recaptcha/docs/faq) - [HTML contact form](https://formgong.com/en/docs/html/) [Get a form key](https://formgong.com/en/#top)