reCAPTCHA v2 vs v3 Explained

reCAPTCHA v2 shows a visible challenge — the "I'm not a robot" checkbox and image grids. reCAPTCHA v3 runs silently in the background and returns a score without any user interaction.

Both versions protect against bots, but they work in fundamentally different ways. This guide breaks down the key differences and explains how to handle each version.

Side-by-side comparison

How reCAPTCHA v2 works

1. Page loads api.js and renders the checkbox widget
2. User clicks "I'm not a robot"
3. Google analyzes browser signals (cookies, mouse movement, IP)
4. If signals are clean → immediate pass
5. If suspicious → image grid challenge appears
6. User solves the grid → token generated
7. Site backend verifies token with Google

<!-- v2 on the page -->
<div class="g-recaptcha" data-sitekey="6Le-wvkSAAAAAPBMRTvw..."></div>
<script src="https://www.google.com/recaptcha/api.js"></script>

How reCAPTCHA v3 works

1. Page loads api.js?render=SITEKEY — no visible widget
2. JavaScript continuously monitors user behavior
3. When an action triggers, grecaptcha.execute() is called
4. Google returns a token with an embedded score
5. Site backend verifies token and reads the score
6. Backend decides: allow, challenge, or block based on score

<!-- v3 on the page -->
<script src="https://www.google.com/recaptcha/api.js?render=6LfZil0UAAAAADM1..."></script>
<script>
  grecaptcha.ready(function() {
    grecaptcha.execute('6LfZil0UAAAAADM1...', {action: 'submit'}).then(function(token) {
      document.getElementById('g-recaptcha-response').value = token;
    });
  });
</script>

How to identify which version a site uses

See How to Identify reCAPTCHA Version for detailed detection steps.

Solving v2 with CaptchaAI

import requests, time

# Submit v2 task
resp = requests.get("https://ocr.captchaai.com/in.php", params={
    "key": "YOUR_API_KEY",
    "method": "userrecaptcha",
    "googlekey": "6Le-wvkSAAAAAPBMRTvw...",
    "pageurl": "https://example.com/form",
    "json": 1
})
task_id = resp.json()["request"]

# Poll for token
for _ in range(30):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": "YOUR_API_KEY", "action": "get", "id": task_id, "json": 1
    }).json()
    if result.get("status") == 1:
        v2_token = result["request"]
        break

Solving v3 with CaptchaAI

# Submit v3 task — note the version and action parameters
resp = requests.get("https://ocr.captchaai.com/in.php", params={
    "key": "YOUR_API_KEY",
    "method": "userrecaptcha",
    "version": "v3",
    "googlekey": "6LfZil0UAAAAADM1...",
    "action": "submit",
    "pageurl": "https://example.com/form",
    "json": 1
})
task_id = resp.json()["request"]

for _ in range(30):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": "YOUR_API_KEY", "action": "get", "id": task_id, "json": 1
    }).json()
    if result.get("status") == 1:
        v3_token = result["request"]
        break

Key difference: v3 requires version=v3 and action parameters.

When sites use both

Many sites use v3 as the first layer and fall back to v2 if the v3 score is low:

1. v3 runs silently on page load → score = 0.2
2. Site threshold is 0.5 → v3 fails
3. Site shows v2 checkbox as fallback
4. User solves v2 → access granted

Strategy for automation:

1. Try v3 first — it's faster and cheaper
2. If the site still blocks you, look for a v2 fallback
3. Solve the v2 challenge and submit that token instead

Which version is harder to solve?

v2 is more reliable but slower. You always get a pass/fail result. v3 is faster but less predictable. The token may have a low score that the site rejects.

FAQ

Can a site use both v2 and v3?

Yes. This is a common pattern — v3 runs first, and v2 appears as a fallback for low scores.

Do v2 and v3 use the same sitekey?

No. Each version has its own sitekey. A v2 sitekey will not work for a v3 solve and vice versa.

Which version should I solve first?

Try v3 first — it's faster and does not require image recognition. If the token is rejected, fall back to v2.

Can I tell the reCAPTCHA version from the sitekey alone?

No. The sitekey format is the same for both versions. You must check how the page loads and uses the captcha.

Is reCAPTCHA v3 replacing v2?

Google still supports both versions. Many legacy sites use v2, and new sites often deploy v3. Enterprise customers can choose either or both.

Related guides

• How to Identify reCAPTCHA Version
• How to Solve reCAPTCHA v2 Using API
• How to Solve reCAPTCHA v3 Automatically Using API
• How to Solve reCAPTCHA Invisible Using API