Invisible CAPTCHA

The truly invisible CAPTCHA is no CAPTCHA at all.

Invisible reCAPTCHA, reCAPTCHA v3 and Cloudflare Turnstile all promise bot protection your visitors never see — and each keeps that promise for most visitors, then quietly breaks it for the ones it isn't sure about. SpamKill puts nothing in front of the form. It decides after capture, at 99.9% accuracy, and a flagged real person verifies in one step and comes straight through.

Invisible for every visitor, not most: no badge, no widget, nothing to solve — and a record of every blocked submission, reviewable depending on your plan.

Compare the Options
The candidates

What "invisible CAPTCHA" actually means

Three real products answer to the name. Here's what each one does — fairly stated.

Invisible reCAPTCHA badge
reCAPTCHA v2 without the checkbox. The test runs silently and the image puzzle appears only when Google is suspicious — so it's the familiar puzzle on a trigger, not gone. The badge and Google's script sit on every protected page.
reCAPTCHA v3
Never shows anything. It watches the visit and returns a score from 0.0 to 1.0 — and stops there. The threshold, the block, the fallback for a real person who scores low, and any review of what was turned away are all left for your team to build.
Cloudflare Turnstile
Silent browser checks with no image puzzles — genuinely the best of the challenge widgets. But it can still show an interactive check when it isn't sure, and like the others it decides before the submission exists. Turnstile vs reCAPTCHA →

All three share one design decision: they are gates. A gate has to judge the visitor before the form is submitted — so when it's wrong about a real person, the submission never exists, and there is nothing to recover and no record it happened.

The fine print

Invisible for whom?

"Invisible" describes the median visitor's experience. The cost doesn't disappear — it concentrates on a minority you never hear from.

A minority pays for everyone
Score-based systems challenge or reject the visitors they can't classify — disproportionately people on VPNs, privacy browsers, assistive technology, shared office networks, and older devices. Your average looks clean while specific real people quietly have a worse time. What CAPTCHAs do to conversion rates →
No record of who was turned away
None of the three keeps a log of the real people it rejected. A submission that was never captured can't be reviewed, recovered, or even counted — the loss is invisible too.
Not invisible to your privacy policy
Both reCAPTCHA variants run Google code on every protected page and send visitor data to Google — tracking disclosures, consent banners, privacy reviews. Turnstile is genuinely better on this front; the gate model is what it keeps.
Bots still get through
Clean residential IPs and real-browser automation earn passing scores, and when a fallback puzzle does appear, solver services pass it for pennies. A gate tests things a bot can rent; behaviour on the form itself is much harder to fake.
0%
User friction
99.9%
Accuracy
100M+
Submissions screened
The no-CAPTCHA option

Invisible because there's nothing to show

SpamKill isn't a CAPTCHA that hides well — it's not a CAPTCHA. Nothing stands in front of the form, so nothing can stop a real person from submitting.

1 · Nothing rendered
No badge, no widget, no challenge, no gate deciding who may submit. Your visitors see a normal contact form and just hit send — on every device, with any assistive technology.
2 · Decides after capture
The submission exists first. SpamKill scores how the form was filled in — timing, movement, input cadence, device signals — at 99.9% accuracy across 100M+ submissions screened for 1,500+ businesses.
3 · Wrong calls are recoverable
A flagged real person verifies in one step and comes straight through — no lead lost to a false flag. And depending on your plan, everything blocked sits in a reviewable queue instead of vanishing.
Side by side

Every invisible option, compared

The rows that matter — starting with what happens to a real person each one gets wrong.

Invisible reCAPTCHA
reCAPTCHA v3
Turnstile
SpamKill
What real people see
⚠ Badge — puzzles on suspicion
⚠ Nothing — until a low score blocks them
⚠ Usually nothing; a check when unsure
✓ Nothing — only the rare flagged visitor gets one verification step
When it doubts a real person
✗ Image puzzle
✗ Turned away — no fallback unless you build one
⚠ Interactive check
✓ One-step verify, straight through
Decides
✗ Before the submission exists
✗ Before the submission exists
✗ Before the submission exists
✓ After capture
Record of blocked leads
✗ None
✗ None
✗ None
✓ Every one, reviewable depending on plan
Third-party code & data flow
✗ Google, every page
✗ Google, every page
Cloudflare
✓ No third-party tracking

Want the whole category, competitors included? The CAPTCHA alternatives comparison covers eight options, from the free DIY route up. Leaving reCAPTCHA specifically? Start at the reCAPTCHA alternative page.

Making the switch

Invisible protection in four steps

A swap, not a stack — a flagged real person can always verify straight through, so the switch doesn't cost you leads.

  1. Put SpamKill on the form. Run your existing form HTML through the Form Transformer and get the protected version back — no signup and nothing to install just to see it.
  2. Take the CAPTCHA off the same form — invisible or not. Swap, don't stack: even an invisible gate keeps turning some real people away before SpamKill can capture and verify them. The 30-day trial — no credit card — makes the swap free to try.
  3. Audit the blocked queue. The trial includes blocked-lead review — so you check the false-positive rate against your own traffic instead of taking ours on faith, and flag anything wrongly caught with one click.
  4. Keep your site-level protection. A WAF or bot-management rule at your CDN inspects traffic at a different layer and can stay. The rule is one gate per form — not zero protection everywhere else.
Common questions

Invisible CAPTCHA, answered

A CAPTCHA that tries to verify visitors without showing them a challenge. In practice the term means one of three products: Google's invisible reCAPTCHA badge (v2 without the checkbox — the puzzle appears only on suspicion), reCAPTCHA v3 (never shows anything; returns a 0.0–1.0 score your team acts on), and Cloudflare Turnstile (silent browser checks, with an interactive check when it isn't sure). "Invisible" describes the default experience, not a guarantee — each one still challenges or turns away the visitors it can't classify.

For most visitors, yes. But the invisible badge version still triggers image puzzles whenever it's unsure, and v3 hands you a score with nothing built in for the real person who scores low — Google's own guidance is to add your own verification step. It also isn't invisible to your page or your privacy policy: the badge, Google's script on every protected page, and the data flow to Google all remain.

Less than visible puzzles for the median visitor — that's the genuine improvement. The cost concentrates on the minority who score poorly: people on VPNs, privacy browsers, assistive technology, shared office networks, and older devices. They get challenged or quietly turned away, and because none of these tools keeps a record of the real people they reject, that loss never appears in any report.

Yes. Score-based systems are gamed with clean residential IPs and real-browser automation that accumulates a normal-looking history, and when a fallback puzzle does appear, solver services pass it for pennies. SpamKill scores behaviour on the form itself — timing, movement, and input cadence, signals a bot can't outsource — at 99.9% accuracy across 100M+ submissions screened.

No — it's invisible, but it isn't a CAPTCHA. There is no badge, no widget, and no gate deciding who may submit: your visitors see a normal contact form. SpamKill decides after the submission is captured, so nothing is ever lost to the decision — a flagged real person verifies in one step and comes straight through, and depending on your plan you can review everything that was blocked.

Don't — swap, not stack. Even an invisible gate keeps turning some real people away before SpamKill can capture and verify them, so stacking the two keeps exactly the silent losses you came here to remove. Put SpamKill on the form, take the CAPTCHA off the same form, and judge the blocked queue on your own traffic during the 30-day free trial — no credit card. Site-level bot management at your CDN is a different layer and can stay.

Compare the whole category:

All CAPTCHA alternatives vs reCAPTCHA vs Turnstile vs hCaptcha

Your visitors never see it. You see everything.

That's the difference between an invisible CAPTCHA and no CAPTCHA: one hides the gate, the other removes it. Swap SpamKill in for the 30-day trial, watch the blocked queue on your own traffic, and let real people just hit send. No card required.

Free trial · No credit card · See full pricing