Captcha plugins protect the site's forms — registration, contact, login — against automated spam submissions by asking the sender to prove they are not a script.
Joomla ships with at least one captcha plugin, and others can be installed. Which ones are available depends on the Joomla version the site is running, so the list to trust is the one in the administrator under System → Plugins, filtered to the captcha type.
A captcha plugin has to be enabled and configured before it does anything. Once it is, choose it as the site-wide default in System → Global Configuration → Site → Default Captcha; individual forms can then use it. The reCAPTCHA plugin needs an account with Google and a pair of site keys, and the setup instructions appear when the plugin is opened in the administrator. reCAPTCHA is a Google service and is not affiliated with or endorsed by the Joomla Project.