Companies Using hCaptcha

When we first started tracking hCaptcha it served a narrow audience. That changed in April 2020, and the data since shows what two anchor customers can do for a privacy-positioned CAPTCHA.

1. Growth trajectory: from dormant to 175K domains in six years

hCaptcha sat at 4 active domains as late as March 2020. That April, Cloudflare announced it was moving from Google's reCAPTCHA to hCaptcha, citing data-handling concerns and reCAPTCHA's shift to a paid model at scale. Our earlier records show 517 domains by December 2020, 11,358 by December 2022, then a steep run through mid-2024 from 40,388 in July to 115,666 in September, and a peak of 159,797 in April 2025.

We now detect 174,847 domains, up from 90,120 in June 2026. The step across that gap is smaller here than anywhere else in this category, and that is a fact about hCaptcha rather than about our crawler: it exposes a script source, DOM elements, a CSS hook, three JavaScript globals and a content-security-policy entry, so it is hard for any crawler to miss. Akamai Bot Manager, detectable only from cookies, differs by a factor of five across the same gap.

Sales signal: Growth continues but the composition has changed. hCaptcha still takes domains from reCAPTCHA at a 2.6:1 rate, yet it now loses more to Cloudflare than it gains from anyone except Google. The addressable pool is companies on reCAPTCHA that care about privacy compliance and are not already Cloudflare customers, because those prospects will default to Turnstile.

2. Customer profile: small, young and European

I previously described this base as enterprise-heavy. The enriched data does not support that, and the correction changes how the list should be used. 64.9% of hCaptcha companies have 1-10 employees, 86.6% have 50 or fewer, and only 0.38% employ more than 10,000. What misled me was reading a notable-companies list sorted by headcount as though it described the distribution. It describes the tail.

Age follows the same shape: 36.02% were founded in the 2010s and 20.43% in the 2020s, with 6.1% predating 1960. By company type, 48.66% are privately held and 11.71% public.

The large names are real and worth naming, Orange, Crédit Agricole, TikTok, Renault, Michelin, NVIDIA, ASML, British Airways, Shopify, Revolut, but they sit on top of tens of thousands of very small sites, many of which arrived through Shopify's checkout rather than by choosing hCaptcha at all.

Sales signal: Segment this list before you use it. The enterprise slice is 218 companies at 10,001+ employees, and those are worth named-account treatment in banking, automotive and industrials. The other 99.6% is a self-serve, price-sensitive audience where a high-touch motion will not pay for itself.

3. Industry and geographic signals

Industry distribution is flat, with no vertical above 6%: Retail 5.98%, Construction 4.07%, IT Services and IT Consulting 3.5%, Business Consulting 2.68%, Retail Apparel and Fashion 2.59%, Software Development 2.35%. Retail and Retail Apparel together reach 8.57%, and the reason is structural rather than a preference, since hCaptcha ships inside Shopify's checkout and 25.04% of all hCaptcha domains are Shopify stores.

Geography is the most distinctive thing about this profile. The United States accounts for only 27.2% of enriched customers, the lowest US concentration of any product in this category, against Germany at 11.5%, the United Kingdom at 8.9% and France at 8.7%, across 195 countries. English-speaking markets are just 43.2% of the base. Germany and France together nearly equal the United States.

A second signal confirms it. Matomo, the self-hosted analytics tool chosen almost exclusively for data-protection reasons, runs on 3.3% of hCaptcha domains against 1.27% of reCAPTCHA's. The same buyers who refuse Google Analytics refuse Google's CAPTCHA.

Sales signal: European companies in regulated verticals are the strongest segment here, and the privacy argument is doing measurable commercial work rather than just marketing work. Target compliance officers and CISOs in Germany and France with a privacy-versus-reCAPTCHA angle, and use Matomo co-presence as a qualifying signal.

4. The competitive picture: CAPTCHA wars

hCaptcha ranks #4 of 32 with a 3.44% share. Above it, reCAPTCHA holds 65.26% and Cloudflare Bot Management 26.04%, but the number that matters is the one immediately above: Cloudflare Turnstile at 3.68%, ahead by just 12,329 domains.

That is the real contest, and hCaptcha is currently behind in it. Turnstile makes nearly the same argument, privacy-first verification without Google, is also free, and is distributed through a CDN that already fronts a third of the web. Against Turnstile, hCaptcha runs 160 gained to 257 lost. Against Cloudflare Bot Management the gap is wider, 174 gained to 941 lost.

Pricing still favours hCaptcha at the entry point. Its free tier covers 100K requests a month with Pro at $99, while Google's reCAPTCHA caps free use at 10,000 assessments a month. Turnstile is free without a cap, which is why price is not the axis hCaptcha can win on.

Sales signal: Companies on reCAPTCHA that were caught out by Google's free-tier reduction remain the best migration targets, and hCaptcha still wins that comparison 2.6:1. But if the prospect already runs Cloudflare, expect to lose to Turnstile; only 35.61% of hCaptcha domains sit behind Cloudflare, against 63.46% of Turnstile's, so the strongest pipeline is explicitly non-Cloudflare infrastructure.

5. What hCaptcha's adoption says about the broader market

The Cloudflare migration in 2020 proved large-scale CAPTCHA switches are possible. Shopify followed, and in hCaptcha's own published case study picked it to protect merchant logins and limited-release product drops. Six years on, our data shows how much that single integration still shapes the product's footprint: a quarter of all hCaptcha domains are Shopify stores, and that alone explains the retail concentration, the small median company size and much of the international spread.

It is also a strategic dependency worth naming. hCaptcha's two defining moments were both platform decisions made by other companies, and Cloudflare has since built and shipped a competing product of its own. CAPTCHA selection in 2026 turns on privacy compliance, free-tier economics and detection accuracy as AI solvers improve, but distribution through a platform still beats all three.

Sales signal: The privacy alternative message still works, and the German and French numbers prove it. Treat hCaptcha adoption outside Shopify as a deliberate choice and a signal that the company takes both bot protection and data governance seriously; treat hCaptcha on a Shopify store as a default that the merchant probably did not choose.

G2 review signals

Our detection data combined with G2 sentiment points in one direction. The handful of reviewers consistently praise simple, effective CAPTCHA questions as the standout strength. Sample size is small (3 sentiment snippets), so treat the signal as directional, not statistical.

Key takeaways

hCaptcha is the largest CAPTCHA provider not owned by Google or Cloudflare, at 174,847 active domains and 3.44% share, ranking #4 of 32. The customer base is small, young and unusually European: 86.6% of these companies have 50 or fewer employees and only 27.2% are US-based, the lowest US concentration in the category.

Two numbers frame its position. It takes domains from reCAPTCHA at 2.6:1, so the founding argument still converts. But Cloudflare Turnstile now leads it by 12,329 domains and beats it in both direct corridors, and Turnstile is free without a request cap. hCaptcha's defensible ground is buyers who want bot protection independent of both Google and their CDN provider, which is a real constituency, and the German and French concentration shows where it lives.

Sales applications

For sales teams using TechnologyChecker.io data, hCaptcha adoption signals an organisation that is security-conscious and privacy-aware, provided it is not simply inheriting the tool from Shopify. Target these companies with: (1) complementary security products such as WAFs, DDoS protection and fraud detection, (2) compliance and audit tooling for organisations already invested in privacy-first infrastructure, weighted toward Germany and France, and (3) migration services for the companies still on reCAPTCHA. Filter by hCaptcha on TechnologyChecker.io to surface 174,847 active domains and 63,299 enriched company profiles with industry, size and geographic data.

Explore the full dataset at TechnologyChecker.io and filter across 174,847 hCaptcha domains with 63,299 enriched company profiles.