reCAPTCHA Enterprise Explained: vs v3 and v2

reCAPTCHA Enterprise is the paid, Google Cloud version of reCAPTCHA. It uses the same widgets as the free product — score-based keys that behave like v3 and checkbox keys that behave like v2 — but adds finer scores, explanations for low scores, and fraud features such as account and password defence. Google now sells it as part of Google Cloud Fraud Defense, in tiers. This guide explains what actually differs from classic v2 and v3, how to tell which version a page uses, and what it changes for teams that run legitimate automation. For the basics of scoring, start with how the reCAPTCHA v3 score works.

What reCAPTCHA Enterprise is now

It is reCAPTCHA delivered through Google Cloud. Google's reCAPTCHA overview describes it as part of Fraud Defense, a platform for bot, account and transaction protection, sold in three usage-based tiers: Essentials, Premium and Enterprise. The site's page gets a token, the site's backend sends that token to Google in an assessment request, and Google returns a risk score from 0.0 to 1.0 with, on higher tiers, reason codes.

The naming causes confusion. People say "reCAPTCHA Enterprise" for the whole Google Cloud product, but Enterprise is also the name of its top tier. When someone says a site "uses Enterprise", they usually mean it loads the Google Cloud version of the script.

How it differs from classic v2 and v3

The widgets look the same to visitors; the differences are in what the site gets back. From Google's tier comparison:

The four-level limit on classic keys comes from Google's assessment guide: without a billing account only 0.1, 0.3, 0.7 and 0.9 are returned. Google states that Essentials is free up to 10,000 assessments a month, shared across an organisation; we leave out paid prices because they change and depend on commitments.

Score-based keys and checkbox keys

Enterprise has two kinds of key, and they behave like the classic versions:

• Score-based keys run invisibly, like v3. The page calls grecaptcha.enterprise.execute() with an action name and the backend reads a score. A Google community guide recommends them for high-stakes actions such as logins, payments, sign-ups and password resets.
• Checkbox keys behave like v2: the widget decides when to show a challenge and the token is valid or not. The same guide recommends them where development resources are limited or the action is less sensitive.

Paid tiers add policy-based challenges, which let a site decide when a challenge appears based on its own rules.

Reason codes: why a score was low

On paid tiers, low scores can come with reason codes explaining the decision. Google lists, among others, AUTOMATION (the interaction looks like an automated agent), UNEXPECTED_ENVIRONMENT, TOO_MUCH_TRAFFIC, UNEXPECTED_USAGE_PATTERNS and LOW_CONFIDENCE_SCORE. Google notes that only some scores carry reason codes, so an unexplained low score is not a misconfiguration.

How to tell which version a page uses

Look at the script the page loads and the function it calls:

Google's instrumentation guide confirms the Enterprise script URL (enterprise.js?render=KEY_ID) and the grecaptcha.enterprise.ready() and execute() calls. A migrated classic key may still load the classic script, so check both the script and the network requests to /recaptcha/enterprise/ before deciding.

Migrating classic keys

Site owners can move existing keys to Google Cloud without code changes. Google's migration guide says it takes 5–10 minutes, keeps the existing page code and the siteverify backend call working, supports v2 checkbox, v2 invisible and v3 keys, and requires billing on the destination project; charges apply above the free monthly allowance. Account and password defence need code changes on top.

What Enterprise means for automation

For authorised automation, Enterprise matters in three ways. Scores are finer on paid tiers, so a borderline session is easier for the site to separate out. Reason codes tell the site why it scored you low, which makes automated traffic easier to spot over time. And sites using account defence look at behaviour across sessions, not just one request, so a clean token from an otherwise unusual session achieves less than it would against classic v3.

The practical rules are the same as for any reCAPTCHA: send the action the page uses, use the token within two minutes (Google's guidance is to create the assessment within two minutes of generating the token), and keep the session consistent, as covered in why captcha tokens get rejected.

What CaptchaNo supports today

CaptchaNo's recaptcha_enterprise type handles Enterprise checkbox-style widgets — the v2 behaviour, including invisible ones — with the same request shape as our reCAPTCHA v2 solver. Score-based Enterprise keys are not currently supported; our v3 solver is for classic v3 keys loaded from api.js. We would rather say that plainly than sell you a token that fails. The request format is in the API reference.

Frequently Asked Questions

What is the difference between reCAPTCHA v3 and reCAPTCHA Enterprise?

Classic v3 is free and returns a score from four possible values with no explanation. reCAPTCHA Enterprise is the Google Cloud version, sold in tiers, whose paid tiers return eleven score levels, reason codes for low scores, and extra fraud features such as password and SMS defence. Visitors see no difference; the site gets more detail.

Is reCAPTCHA Enterprise free?

Partly. Google's Essentials tier is free up to 10,000 assessments a month per organisation, and higher tiers are paid. Paid tiers are what unlock eleven score levels and reason codes. Migrating classic keys requires a billing account on the Google Cloud project even if usage stays under the free allowance.

How do I know if a site uses reCAPTCHA Enterprise?

Check the page source and network requests. Enterprise loads recaptcha/enterprise.js and calls grecaptcha.enterprise functions, and its requests go to paths containing recaptcha/enterprise. Classic reCAPTCHA loads recaptcha/api.js. A key migrated to Google Cloud without code changes may still use the classic script.

Does reCAPTCHA Enterprise show a challenge?

It depends on the key type. Score-based keys are invisible and only return a score. Checkbox keys behave like reCAPTCHA v2 and show a challenge when the widget decides the visitor is uncertain. Paid tiers can also show policy-based challenges when the site's own rules call for one.

How long is a reCAPTCHA Enterprise token valid?

Google's guidance is to create the assessment within two minutes of the token being generated, the same window as classic reCAPTCHA. That is why sites should call execute when the user acts rather than on page load, and why automation should generate the token immediately before the request that uses it.

Handle Enterprise checkbox widgets

Start a free CaptchaNo trial to solve Enterprise checkbox-style widgets in automation you are authorised to run. If you are choosing a widget for your own site, compare Turnstile and reCAPTCHA first.