Companies Using hCaptcha

When we first started tracking hCaptcha, it served a narrow audience. That changed in April 2020, and the data since shows what a single anchor customer can do for a privacy-positioned CAPTCHA.

1. Growth trajectory: from dormant to 154K domains in five years

Our detection data shows hCaptcha sat at just 3 active domains until April 2020. That month, Cloudflare announced it was moving from Google's reCAPTCHA to hCaptcha, citing data-handling concerns and reCAPTCHA's shift to a paid model at scale. By December 2020 active domains had reached 499. By December 2022, 11,148. The biggest jump came in mid-2024: active domains went from 39,669 in July to 112,096 in September, close to a 3x increase in two months. Peak detection hit 154,615 active domains in April 2025. hCaptcha now holds 1.76% of the security tools market, sitting at #3 overall. Within the CAPTCHA-specific segment, it's the largest independent provider. The product is built by Intuition Machines, Inc., which also markets the service to enterprise fraud and MFA buyers.

Sales signal: Growth is decelerating from its 2024 peak, but the addressable migration pool is still large. Target companies still running reCAPTCHA that care about privacy compliance or want to reduce dependency on Google. The migration is a well-trodden path with public case studies.

2. Customer profile: enterprise-heavy with a long tail

Our enriched company data points to a customer base that skews toward established organizations. The age distribution shows 42.46% of hCaptcha companies were founded in the 2010s, and another 24.34% in the 2020s. So about two-thirds are relatively young, but the remaining third includes organizations founded before 2000, some going back well over a century (Siemens, 1847; Credit Agricole, 1885). The top companies list reads like a global Fortune 500 directory: Bank of America, Oracle, SAP, Johnson & Johnson, Samsung, Nike, Tesla, Coca-Cola, and Delta Air Lines. These aren't small blog operators picking a free CAPTCHA. They're regulated enterprises that picked hCaptcha for privacy and compliance reasons.

Sales signal: The enterprise concentration is a useful filter for B2B security and compliance vendors. Companies deploying hCaptcha tend to have dedicated security teams, GDPR/PCI/HIPAA obligations, and large digital surfaces. They're likely buyers of adjacent products: WAFs, DDoS protection, identity verification, and fraud detection.

3. Industry and geographic signals

Based on our top company data, hCaptcha's customer base spans an unusually broad range of industries. Banking and financial services (Bank of America, UBS, Credit Agricole, RBC) is one significant cluster. IT services and consulting (Capgemini, Oracle, Fujitsu) is another. Motor vehicle manufacturing (Tesla, Renault, Michelin, Cummins) is well-represented. So are retail (Nike, Family Dollar, Dollar Tree), hospitality (Hyatt), airlines (Delta), healthcare (Johnson & Johnson, Medtronic), and government (Government of Canada). The horizontal spread makes sense. Bot protection isn't industry-specific.

Geographically, the United States dominates our top company data, followed by Germany and France. The European weight is notable and likely tied to hCaptcha's privacy positioning. Post-GDPR, European companies face real regulatory pressure around data collection, and hCaptcha's pitch as a reCAPTCHA alternative that doesn't feed Google's ad network resonates well there.

Sales signal: European companies in regulated verticals (banking, healthcare, government) are the strongest growth segment. Target compliance officers and CISOs with a privacy-vs-reCAPTCHA angle.

4. The competitive picture: CAPTCHA wars

hCaptcha occupies a specific niche inside the broader security tools category. The market share data shows Imunify360 at #1 (4.01%) and Akamai Bot Manager at #2 (2.03%), but these solve different problems. Imunify360 is server-level security for hosting providers. Akamai Bot Manager is CDN-integrated enterprise bot mitigation. hCaptcha's actual rivals are reCAPTCHA and Cloudflare Turnstile (0.55%). ReCAPTCHA appears at just 754 domains in our data, though that number is misleadingly low because many reCAPTCHA implementations load via tag managers rather than direct script tags. Cloudflare Turnstile, launched in 2022, is growing fast at 48,488 domains and is the most direct competitive threat. Turnstile doesn't require visual challenges at all, which is a clear UX advantage.

Pricing is also part of the gap. hCaptcha's free tier covers 100K requests/month, with Pro at $99/month (100K evaluations included). Google's reCAPTCHA documentation caps the free tier at 10,000 assessments/month, a tenth of hCaptcha's.

Sales signal: Companies on reCAPTCHA that were caught off-guard by Google's 2024/2025 pricing changes (free tier cut from 1M to 10K) are prime migration targets. Cloudflare Turnstile is the rising threat. If a company already uses Cloudflare for CDN, Turnstile is a natural choice. Focus on non-Cloudflare prospects for hCaptcha's strongest pipeline.

5. What hCaptcha's adoption says about the broader market

The Cloudflare migration in 2020 proved that large-scale CAPTCHA switches are possible. Shopify followed. In hCaptcha's own published case study, Shopify picked hCaptcha to protect merchant logins and limited-release product drops. CAPTCHA selection in 2026 is driven by privacy compliance (avoiding Google data collection), free-tier economics, and detection accuracy as AI solvers improve. With 91,498 enriched profiles in our dataset, the customers tracked here have collectively bet on hCaptcha as their defense against automated abuse.

Sales signal: The "privacy alternative to reCAPTCHA" message still works. hCaptcha's real moat is its ML-powered detection that adapts as AI agents improve. Treat hCaptcha adoption as a signal that a company takes bot protection seriously and may be open to complementary security tools.

G2 review signals

Our detection data combined with G2 sentiment points in one direction. The handful of reviewers consistently praise simple, effective CAPTCHA questions as the standout strength. Sample size is small (3 sentiment snippets), so treat the signal as directional, not statistical.

Key takeaways

hCaptcha is the largest independent CAPTCHA provider by our count, going from near-zero to 154K+ active domains in five years. The customer base is enterprise-heavy, geographically diverse (with notable European strength), and spans most major industries. Growth was catalyzed by the Cloudflare and Shopify migrations, then sustained by ongoing demand for privacy-compliant bot protection. With 91,498 enriched companies in our dataset and 220,735 domains that previously used hCaptcha, the platform's total reach extends well beyond the current active count.

Sales applications

For sales teams using TechnologyChecker.io data, hCaptcha adoption is a signal that an organization is security-conscious and privacy-aware. Target these companies with: (1) complementary security products like WAFs, DDoS protection, and fraud detection, (2) compliance and audit tools for orgs already invested in GDPR/privacy-first infrastructure, and (3) migration services for companies still evaluating a switch from reCAPTCHA. Filter by hCaptcha on TechnologyChecker.io to surface 154,214 active domains and 91,498 enriched company profiles with industry, size, and geographic data.

Explore the full dataset at TechnologyChecker.io and filter across 154K+ hCaptcha domains with 91,498 enriched company profiles.