Turnstile vs reCAPTCHA: how the two compare

What each product is

Turnstile is Cloudflare's CAPTCHA replacement. Cloudflare describes it as a privacy-preserving alternative that can be embedded into any website without sending traffic through Cloudflare, so you do not need your domain on Cloudflare's network to use it. It runs small non-interactive JavaScript challenges — proof-of-work, proof-of-space and browser API probing — and adjusts difficulty per visitor rather than showing a visual puzzle.

reCAPTCHA is Google's long-running equivalent, now folded into Google Cloud Fraud Defense: "reCAPTCHA has become a part of Google Cloud Fraud Defense, a fraud and abuse prevention platform for bot, account, and transaction protection." The classic integrations remain: v2 checkbox, v2 invisible, v2 Android, and v3, which scores traffic in the background. Google Cloud's assessment API returns a risk score from 0.0 to 1.0 plus reason codes.

Both ship several modes, and which one is less intrusive depends entirely on which mode is deployed:

Do image challenges appear?

Turnstile has no image-puzzle path. Cloudflare's documentation is explicit that Turnstile verifies visitors without displaying visual puzzles, and the most demanding thing managed mode will ask for is a checkbox click. Turnstile is WCAG 2.2 AA compliant on both plans, with WCAG 2.2 AAA support listed under Enterprise.

reCAPTCHA v2 checkbox is the mode most people picture, and it is the one that can escalate to a grid of traffic lights or crosswalks. v2 invisible does the same thing, only triggered by a button or grecaptcha.execute() rather than a checkbox. v3 does not challenge at all — but that also means v3 alone blocks nothing. You get a number, and you build the enforcement.

So the accurate framing is not that Turnstile has no CAPTCHA and reCAPTCHA does. It is that Turnstile's worst case is a click, reCAPTCHA v2's worst case is an image grid, and reCAPTCHA v3's worst case is that your own threshold is wrong and you silently block real users.

Privacy and data handling

reCAPTCHA sets a cookie. Google's FAQ states: "reCAPTCHA sets a necessary cookie (_GRECAPTCHA) when executed for the purpose of providing its risk analysis." Google also documents serving the script from www.recaptcha.net instead of www.google.com for sites that want to avoid additional Google cookies — a workaround that exists because the default behaviour draws compliance complaints in the EU.

Cloudflare positions Turnstile on the opposite footing. Its general-availability announcement says Turnstile "meets ePrivacy Directive, GDPR and CCPA compliance requirements" and that "we don't rely on tracking user data, like what other websites someone has visited, to determine if a user is a human or robot", adding that Cloudflare's business is protecting websites rather than selling ads. Cloudflare publishes a Turnstile Privacy Addendum, and using invisible mode requires you to reference that addendum in your own privacy policy.

Turnstile is not cookie-free in every configuration either. If you enable pre-clearance, "a cf_clearance cookie is issued to the visitor in addition to the default Turnstile token", which lets a visitor bypass subsequent WAF challenges on a matching Cloudflare zone. That is opt-in and functional rather than analytic, but it is a cookie, and your consent copy should say so.

Neither product is a zero-data system: both receive an IP address, both run code in the visitor's browser, and both accept an optional remoteip on server-side verification. The difference is stated purpose and corporate incentive, not the absence of collection.

Free tiers and pricing

This is where the two diverge hardest. Turnstile's free plan is limited by shape — how many widgets and hostnames you configure — not by traffic. reCAPTCHA bills per assessment above a monthly allowance.

Legacy standalone reCAPTCHA keys carry their own ceiling. Google's FAQ states that if you want to make more than 1,000 calls per second or 1,000,000 calls per month you must use reCAPTCHA Enterprise. Exceeding the quota degrades quietly rather than erroring cleanly:

• v3 over quota returns a static score of 0.9 — your risk signal disappears without an exception being raised.
• v2 over quota shows the visitor "This site is exceeding reCAPTCHA quota."
• Both failure modes are worth alerting on, because neither looks like an outage in your own logs.

Integration differences

The two integrations are structurally the same and differ in names, limits and one strictness rule. If you have written one, you can read the other.

The error-code vocabulary overlaps almost exactly: both return missing-input-secret, invalid-input-secret, missing-input-response, invalid-input-response, bad-request and timeout-or-duplicate. Turnstile adds internal-error, for which Cloudflare recommends a retry. Turnstile's idempotency_key (a UUID) exists so that retrying a verification of the same token does not trip timeout-or-duplicate; reCAPTCHA has no equivalent, so a retry after a network timeout can burn the token.

# Turnstile: POST only, form-encoded or JSON
curl -sX POST https://challenges.cloudflare.com/turnstile/v0/siteverify \
  -d "secret=$TURNSTILE_SECRET" \
  -d "response=$TOKEN" \
  -d "idempotency_key=$(uuidgen)"
# {"success":true,"challenge_ts":"2026-08-13T09:12:44.000Z","hostname":"example.com"}

# reCAPTCHA v3: same shape, but the verdict is a score you must threshold
curl -sX POST https://www.google.com/recaptcha/api/siteverify \
  -d "secret=$RECAPTCHA_SECRET" \
  -d "response=$TOKEN"
# {"success":true,"score":0.9,"action":"login","hostname":"example.com"}

Both vendors ship test credentials so you can exercise pass and fail paths in CI. Turnstile's dummy sitekeys include 1x00000000000000000000AA (always passes, visible), 2x00000000000000000000AB (always fails, visible) and 3x00000000000000000000FF (forces an interactive challenge), paired with dummy secrets such as 1x0000000000000000000000000000000AA (always passes) and 3x0000000000000000000000000000000AA (returns token-already-spent). Test sitekeys emit the token XXXX.DUMMY.TOKEN.XXXX, which production secrets reject.

Migration notes

Cloudflare publishes a reCAPTCHA migration guide and a compatibility shim. Loading the script with ?compat=recaptcha "enables the following features: implicit rendering for reCAPTCHA, g-recaptcha-response input name for forms, register the Turnstile API as grecaptcha". Existing grecaptcha.render() and execute() calls keep working; you swap in your Turnstile sitekey. The guide covers reCAPTCHA v2, including invisible mode.

<!-- Drop-in replacement for reCAPTCHA v2 markup -->
<script
  src="https://challenges.cloudflare.com/turnstile/v0/api.js?compat=recaptcha"
  async defer></script>

<form method="POST" action="/login">
  <!-- class and field name stay as they were; only the sitekey changes -->
  <div class="g-recaptcha" data-sitekey="0x4AAA..."></div>
  <button type="submit">Sign in</button>
</form>

Server-side, point verification at https://challenges.cloudflare.com/turnstile/v0/siteverify instead of Google's endpoint. One gotcha is called out in Cloudflare's own guide: Turnstile's siteverify "does not support GET requests and only accepts POST requests with a FormData or JSON body". Code that built a query-string GET against Google will fail here.

Other things to plan for: token lifetime shortens or lengthens depending on direction (2 minutes versus 300 seconds), Turnstile's free plan caps you at 20 widgets and 10 hostnames per widget so multi-tenant setups need thought, and your privacy policy and cookie banner both reference the old vendor. If you deploy invisible mode, Cloudflare requires you to reference the Turnstile Privacy Addendum in that policy.

Testing your own protected flows

Once a challenge sits in front of a signup, login or checkout, your own automation stops at it too: end-to-end suites in CI, uptime probes, staging smoke tests, and any attempt to verify that a new anti-bot configuration behaves as intended. Vendor test keys cover the CI case where you control the environment. They do not help when you need to exercise a real deployment with real keys.

SolveGate solves Cloudflare Turnstile — managed, non-interactive and invisible — and Turnstile-backed WAF challenge pages. It does not solve reCAPTCHA, and it does not solve hCaptcha, GeeTest, FunCaptcha or AWS WAF. If your stack is on reCAPTCHA, this page is reference material and nothing more; the comparison above is the useful part.

# gate is "turnstile" for widgets, "waf" for Cloudflare challenge pages
curl -sX POST https://api.solvegate.io/v1/solve \
  -H "Authorization: Bearer $SOLVEGATE_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "gate": "turnstile",
        "sitekey": "0x4AAA...",
        "url": "https://staging.example.com/login"
      }'

# Poll a queued solve by id (polling is free)
curl -s https://api.solvegate.io/v1/solve/sol_123 \
  -H "Authorization: Bearer $SOLVEGATE_SECRET_KEY"

Tokens typically return in under 1.5 seconds. Credits are prepaid, from $0.40 per 1,000 solves down to $0.075 at volume, failed solves are never billed, and the first 1,000 solves are free. SDKs are published as solvegate on npm (Node 18+) and PyPI (Python 3.9+). Use this against properties you own or are authorised to test — QA, CI, uptime monitoring, staging and anti-bot configuration testing.

Common questions

Related

More in Glossary