hCaptcha vs Nolgard
hCaptcha checks that a signup is human. Nolgard checks for linked repeat accounts and tells your backend how many credits to give. Use both when a repeat trial costs you money.
What hCaptcha does better
- A dedicated challenge with server-side verification through
siteverify. It can show a visual challenge when it is unsure; Nolgard never shows one. hCaptcha developer guide - Passive and invisible modes. Pro sitekeys default to a "99.9% Passive" mode; Enterprise adds further passive levels. Pro features ยท Invisible mode
- Enterprise risk scores:
scoreandscore_reasonin thesiteverifyresponse. siteverify docs - A free Basic plan up to 10,000 requests a month. hCaptcha plans
- Mobile app SDKs, listed in its docs. Nolgard covers browsers only; mobile apps are not covered. hCaptcha mobile SDKs
Plan and feature details are hCaptcha's own documentation, read 2026-10-25. Check their docs for current limits.
What hCaptcha does not decide
The documented siteverify response carries success, challenge_ts, hostname and error codes, plus a score on Enterprise. None of it is about the account behind the browser.
- Same person again. One person with a fresh inbox passes on every trial.
- How many credits to give. Pass or fail, or a score. Your backend still has to pick a number.
- What happens after signup. It sits on the form and sees nothing the account does later.
- Referral self-dealing. Both sides are real humans in real browsers. Both pass.
Row by row
| Question | hCaptcha | Nolgard |
|---|---|---|
| Is this session automated? | Yes. This is its job. Score on Enterprise. | Yes. Returns a score, reason ids and a decision. |
| Can it show a challenge? | Yes, including passive modes on paid plans. | No visual challenge. Step-up is email confirmation or proof of work. |
| Is this the same person again? | Not in the documented response. | Yes. Per-site links across browser visitor id, device and normalized email. No per-response visitor id yet. |
| How many credits should this account get? | No. | Yes. grant.share and grant.credits. |
| Is the email disposable, new or an alias? | No. | Yes. MX, domain age, alias folding. |
| Mobile apps | Yes, through its SDKs. | Not covered. Browsers only. |
| Price | Basic free up to 10,000 requests a month; Pro and Enterprise paid. Check their docs for current limits. | Free: 1,000 new accounts a month. Pro $99 for 15,000. Business $299 for 75,000. Pricing |
hCaptcha column from its developer docs and plans page, read 2026-10-25. Nolgard column matches the shipped API docs. How we test, and what we miss: methodology.
Run both for two weeks
- Keep hCaptcha where it is. Add Nolgard's
client.jsand verify each signup that passed hCaptcha, with youraccount.id. - Set the site to Observe mode: we enforce nothing and record
wouldDecide. - Label the accounts you know as
fraudorlegitwithPOST /v1/feedback. - Compare
wouldDecidewith the labels. If thelimitcalls do not line up, you lose nothing.
Use both
Run hCaptcha first and drop the scripts. Then ask Nolgard what the survivor is worth.
const hc = await fetch('https://api.hcaptcha.com/siteverify', { method: 'POST',
body: new URLSearchParams({ secret: HCAPTCHA_SECRET, response: hcToken, remoteip }) }).then(r => r.json());
if (!hc.success) return reject(); // challenge failed: stop here
const nf = await fetch('https://nolgard.com/v1/verify', { method: 'POST', headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ secret: NOLGARD_SECRET, token: nfToken, remoteIp: remoteip, action: 'signup', account: { id, email } }) }).then(r => r.json());
if (nf.success) grantCredits(nf.grant.credits ?? Math.floor(nf.grant.share * FULL_TRIAL));Example server-side flow. Handle network failures and verify errors before granting anything: when verify fails.