reCAPTCHA vs Math Captcha: Which Protects Better?

Three Types, Three Trade-offs

Not all captchas are equal. ShieldmyLinks supports three verification methods — math captcha, reCAPTCHA v2, and reCAPTCHA v3 — and each makes a different trade-off between user friction, bot resistance, and privacy.

---

The Comparison

	Math Captcha	reCAPTCHA v2	reCAPTCHA v3
Visible to user	✅ Yes (question shown)	✅ Yes (checkbox / image grid)	❌ No (invisible)
User friction	Low (2-second mental math)	Medium (image selection rounds)	None
Bot resistance	Medium	High	Medium-High
Sends data to Google	❌ No	✅ Yes	✅ Yes
Setup required	None	reCAPTCHA site key	reCAPTCHA site key
Best for	Community invites, event links	High-value links, downloads	High-volume public links

---

Math Captcha

Math captcha presents a simple arithmetic question — "What is 7 + 4?" — that a human answers in seconds. No external service, no data sent to Google, no cookies.

Strengths:

• Zero setup, works immediately
• No third-party dependency or data sharing
• Fast for genuine users (most people answer in under 3 seconds)
• Highly effective against unsophisticated bots that don't parse and answer HTML forms

Weaknesses:

• Determined attackers with OCR or LLM-based scrapers can solve math questions automatically
• No risk scoring — it's pass/fail only
• No behavioural signal (time-on-page, mouse movement, etc.)

Best for: Community invite links, event registrations, and any use case where user privacy matters and the attacker is an automated scraper rather than a targeted human-assisted bot farm.

---

reCAPTCHA v2

The classic "I'm not a robot" checkbox. Google's system analyses browser fingerprint, mouse movement, and behavioural signals before the checkbox is even clicked. If it's unsure, it shows an image grid challenge ("Select all traffic lights").

Strengths:

• Well-understood by users globally
• Google's ML model is trained on billions of interactions
• Image challenges are extremely difficult for current bots to solve reliably
• Binary pass/fail is easy to enforce

Weaknesses:

• Sends visitor data to Google (IP, browser fingerprint, cookies)
• Image grid challenges frustrate some users
• Requires a Google reCAPTCHA site key (free but needs account setup)

Best for: High-value links — premium downloads, exclusive event registrations, invite-only communities — where strong bot resistance justifies the friction.

---

reCAPTCHA v3

reCAPTCHA v3 is completely invisible. It runs silently in the background and returns a score from 0.0 (very likely a bot) to 1.0 (very likely human). Your application decides what to do with the score.

Strengths:

• Zero user friction — no interaction required
• Score-based: you can set thresholds (block below 0.3, challenge between 0.3–0.7, allow above 0.7)
• Effective for high-volume links where any visible friction would hurt conversion

Weaknesses:

• Score thresholds require tuning — too aggressive blocks real users, too lenient lets bots through
• Still sends data to Google
• Sophisticated bots increasingly know how to achieve decent v3 scores

Best for: High-volume public links, referral programmes, and landing pages where friction would reduce conversion and you need a background filter rather than a hard gate.

---

How to Choose

Choose Math Captcha when:

• You're protecting a community invite link or event registration
• You don't want to share visitor data with Google
• You want zero setup and no external dependencies
• Your attackers are automated scrapers, not targeted bot farms

Choose reCAPTCHA v2 when:

• You need maximum bot resistance for a high-value link
• You've already configured a Google reCAPTCHA site key
• You're comfortable with the image challenge friction for your audience

Choose reCAPTCHA v3 when:

• You're protecting a high-volume public link where friction hurts conversions
• You want a background signal to filter obvious bots without interrupting users
• You have time to tune the score threshold for your specific audience

ShieldmyLinks lets you choose per link — the right tool for each use case, not a one-size-fits-all lock.