hCaptcha pricing: what each plan costs and what it changes.

hCaptcha sells three plans. Basic is $0 with no published eval allowance. Pro is $139 a month billed monthly, or $99 a month billed yearly, and includes 100,000 evals before it charges $0.99 per 1,000. Enterprise is quote-only and adds risk scores, a fully passive mode, and the SLA and SSO machinery large deployments ask for. The plan a site picks also decides whether visitors see a puzzle at all, and what an automated client is up against. Every figure here is from hcaptcha.com/pricing as of August 2026.

The three plans side by side

Basic costs nothing. The pricing page lists no eval allowance and no overage rate against it, so there is no published ceiling to plan around. What the free plan buys is the protection itself, availability in every country, and compliance with GDPR, CCPA, LGPD and PIPL. What it does not buy is any control over how the widget behaves: there are no custom themes or analytics, and none of the passive settings that let low-risk visitors through without a challenge. There is also no published point at which a busy free site gets pushed onto Pro, because the page states no allowance to exceed in the first place. If your volume is large enough for that to be a real question, ask hCaptcha rather than guessing from the page.

Pro is $139 a month if you pay monthly and $99 a month if you pay yearly, a difference of $40 a month or $480 over a year. It includes 100,000 evals a month and charges $0.99 per additional 1,000. The features it adds are Low Friction 99.9% Passive Mode, custom themes, and analytics. hCaptcha also runs a complimentary 14-day Pro trial with no payment required, and the account reverts to the free plan when it ends, so you can measure your own eval count before committing.

Enterprise has no list price. It is everything in Pro plus Risk Scores, a full Passive (No-CAPTCHA) Mode, APT Mitigation Features, Enterprise SLAs, a Multi-User Dashboard with SAML SSO, and Advanced Analytics & Reporting APIs. hCaptcha’s own line on that page is that it is “more accurate and up to 50% more cost-effective than reCAPTCHA”. Treat that as a sales claim rather than a rate you can budget against, because without a published price there is nothing to compare.

What an eval is, and how the bill scales

hCaptcha bills in evals rather than page views or puzzles shown, and the pricing page never defines the word. That gap is where a budget goes wrong, because a visitor who sails through a passive mode without seeing anything has still been evaluated. Count the protected actions where your page runs the widget, not the visitors who end up looking at a grid.

That count is usually larger than people expect. A signup form that renders the widget, gets abandoned, and gets loaded again by the same person has been evaluated more than once. So has a login page that a visitor refreshes, and so has every failed attempt that sends them back through the form. Until an invoice tells you otherwise, assume each pass through a protected action is its own eval and size the plan on that number.

Above the included block the arithmetic is unusually simple, because on the yearly price hCaptcha charges the same rate for the included evals as for the overage:

• 100,000 evals on yearly Pro is the $99 base and nothing else, which works out at $0.99 per 1,000.
• 500,000 evals is $99 plus 400 blocks of 1,000 at $0.99, so $99 + $396 = $495 a month. That is $0.99 per 1,000 again.
• 1,000,000 evals is $99 + $891 = $990 a month, still $0.99 per 1,000.

Paying monthly shifts the fixed part and nothing else. The same 500,000 evals cost $139 + $396 = $535, or $1.07 per 1,000, and the two prices converge as volume grows because the $40 gap is spread over more evals.

Below the included block the rate goes the other way, and it goes there fast. A site doing 20,000 evals a month still pays $99 on the yearly plan, which is $4.95 per 1,000. At that volume the $99 is paying for the passive mode and the themes rather than for capacity. If neither matters to you, Basic does the same protection for $0.

What the plan changes for visitors and for automation

Each tier also changes how the widget behaves in front of the visitor, which makes the pricing page a technical spec as much as a price list.

On Basic, visitors get the standard experience: the checkbox, and a challenge whenever hCaptcha’s risk check does not like the session. The site owner has no dial to soften that. Whatever score a visitor arrives with is what they get.

On Pro, the 99.9% Passive setting aims to challenge fewer than one visitor in a thousand. Most humans never see a puzzle, and the widget resolves to a token quietly. It is a friction setting rather than a security one, and it does not remove challenges: a session that still looks wrong gets the same modal it would have got on the free plan. How that works, and why the token that comes out is identical either way, is in invisible hCaptcha.

On Enterprise, two things change that matter beyond friction. The site gets risk scores back rather than a pass or fail, so it can act on the score in its own logic. And enterprise sitekeys pass a fresh rqdata blob into every challenge, which binds the token that comes out to that specific request and session. A token minted against stale or mismatched rqdata does not verify even when the puzzle was answered correctly, which is why enterprise sitekeys are a different problem from regular ones for anything automated. The mechanism is covered in solving enterprise hCaptcha (rqdata).

If you are on the automation side of this, the plan is the site owner’s choice and you inherit it. You cannot tell from the page which tier is behind a sitekey until you meet its behaviour, so the useful question is not which plan they bought but whether the sitekey passes rqdata.

One thing no plan buys is the absence of challenges. The passive settings move where the threshold sits; they do not remove it, and a site owner who turns them on is still challenging the sessions that score badly. That is worth knowing in both directions. As a site owner, paying for Pro will not stop your riskiest visitors complaining about puzzles. As an engineer automating against the site, a quiet run today is a threshold away from a challenge on every request tomorrow.

What it costs to solve one

The other side of the ledger is what a token costs when you need one rather than deploy one. NoneCap charges $0.20 to $0.50 per 1,000 credits depending on the pack, billed from one credit per challenge round, and hCaptcha decides how many rounds a solve takes. You are charged on success only, so failed solves are never charged. There is no subscription and no monthly minimum, and a new account starts with 1,300 free credits. NoneCap covers hCaptcha only, including invisible and enterprise rqdata sitekeys. Send the sitekey and the page url, and get a real P1_ token back:

curl "https://api.nonecap.com/v1/solves?wait=90" \
  -H "Authorization: Bearer $NONECAP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type":    "hcaptcha",
    "sitekey": "f5ab1c2d-7e8f-4a9b-b1c2-d3e4f5a6b7c8",
    "url":     "https://target.example/login"
  }'

Full rates, pack sizes, and the credit arithmetic are on the pricing page.

Is hCaptcha free?

For the site owner, yes. Basic is $0 and hCaptcha publishes no eval allowance and no overage rate against it, so a site can run the widget indefinitely without paying anything. For the visitor it is also free, and always has been. Nobody is billed for solving one.

The free plan costs you in friction rather than in dollars. Every visitor hCaptcha scores as risky gets a puzzle, and the settings that would have waved most of them through are the ones behind the $99 to $139 a month line. If your signup conversion matters more than $1,188 a year, that is the trade the Pro plan is selling. If it does not, Basic protects the same endpoints for nothing.