The numbers
Medians of 5 cold loads per widget on 16.10.2026, in Google Chrome 155 with a fresh browser profile for every run, so nothing came from the cache. Each widget sat in the same small form and used its vendor's published test site key. “Ready” is the time from opening the page until the widget's own frame finished loading. Ranges are min to max.
| Widget | Transferred | Requests | Hosts | Ready | Click to token |
|---|---|---|---|---|---|
| Turnstile, auto-pass key | 141 KB (140–146) | 3 | 1 | 287 ms (259–362) | no click needed |
| Turnstile, checkbox key | 142 KB (138–146) | 3 | 1 | 316 ms (275–369) | 51 ms (5–66) |
| hCaptcha | 310 KB (310–311) | 6 | 4 | 515 ms (437–639) | 126 ms (110–153) |
| reCAPTCHA v2 | 454 KB (453–454) | 15 | 3 | 951 ms (944–1014) | 267 ms (229–297) |
The hosts were challenges.cloudflare.com for Turnstile; js.hcaptcha.com, newassets.hcaptcha.com, api.hcaptcha.com and a subdomain of hcaptcha.com that changed on every run; and www.google.com, www.gstatic.com and fonts.gstatic.com for reCAPTCHA. With the auto-pass key, Turnstile's token arrived 1.79 s after the page opened (1.77–1.88) without a click. “Transferred” counts every request to the vendor's hosts, including what loads inside the widget's frame, until the token arrived plus three seconds. Of reCAPTCHA's 454 KB, 346 KB were JavaScript files; Turnstile's JavaScript files came to 28 KB.
What the visitor has to do
With the auto-pass test key, Turnstile showed a spinner and then “Success!” without any click, and the token arrived about 1.8 seconds after the page opened. That is what Turnstile's Managed mode does for most visitors: it runs its checks in the background and shows a checkbox only when it is unsure, which is what the second Turnstile row simulates.
hCaptcha and reCAPTCHA v2 always showed a checkbox (“I am human”, “I'm not a robot”), and with their test keys one click was enough. With real keys both can follow the click with an image puzzle when they distrust the visitor. Test keys never do, so the click-to-token times above are the best case. All four widgets printed a red “for testing only” line, which is how you can spot a test key left on a live site.
What these numbers cannot tell you
- Test keys skip the real risk checks. A real Turnstile key may take longer to decide, and a real hCaptcha or reCAPTCHA key may show puzzles. What we measured is the loading cost, which does not depend on the key.
- One network. All runs came from one laptop on a home connection. Absolute times will differ for your visitors; the order and the byte counts should not change much.
- Vendors change their scripts. These are the files they served on 16.10.2026.
- reCAPTCHA v3 is not in the table. It has no published test key, so we could not measure it the same way.
What we would pick for a contact form
On loading cost alone Turnstile wins clearly: a third of reCAPTCHA's bytes, a fifth of its requests, one host instead of three, and no click for most visitors. hCaptcha sits in the middle. If you would rather not show any widget, a honeypot field and server-side checks stop a lot of form spam on their own; see contact form spam without a captcha. Plans, limits and privacy terms of the three services are compared in Turnstile vs reCAPTCHA vs hCaptcha, and the Turnstile error codes in our Turnstile errors guide.
Turnstile with Formgong
Formgong verifies Cloudflare Turnstile on its server for each submission to https://formgong.com/submit. Turn on Require Cloudflare Turnstile in the form settings, add your site key and secret, and put the widget in the form. See the HTML guide.
Frequently asked questions
Which captcha loads fastest, Turnstile, hCaptcha or reCAPTCHA?
On our 5 cold loads in Chrome, Turnstile was ready in about 0.3 s, hCaptcha in about 0.5 s and reCAPTCHA v2 in about 1 s.
How big is the reCAPTCHA script?
Loading the reCAPTCHA v2 checkbox transferred about 454 KB in 15 requests on our test, 346 KB of it JavaScript. Turnstile transferred about 141 KB in 3 requests.
Does Turnstile need a click?
Usually not. In Managed mode it decides in the background and shows a checkbox only when unsure. With the auto-pass test key the token arrived about 1.8 s after page load with no click.
Are captcha test keys a fair benchmark?
For loading cost, yes: the same files load. For solving, no: test keys never show puzzles, so real visitors can take longer with hCaptcha and reCAPTCHA.
Sources and documentation
Official references for this guide: Cloudflare: Turnstile testing (test keys), hCaptcha: Developer guide (test keys), Google: reCAPTCHA FAQ (test keys). HTML contact form, where data is stored.