Free tools Windows power users keep installed
One-click scans. No signup required.
Cloudflare Turnstile is an embeddable alternative to traditional CAPTCHA checks. It runs browser challenges that are usually non-interactive, then gives a website a token that its server must verify before accepting a form or other protected action. A site can use Turnstile without routing its traffic through Cloudflare.
What is Cloudflare Turnstile?
Turnstile is Cloudflare’s challenge service for helping websites distinguish legitimate visitors from automated traffic. Cloudflare announced it as an open-beta, invisible CAPTCHA alternative on September 28, 2022; it reached general availability on September 29, 2023. Unlike a conventional image puzzle, Turnstile can assess a browser without routinely asking the visitor to solve a challenge.
It is an integration for website owners and developers, not a browser extension or a standalone app for visitors. Cloudflare says it can be embedded on websites that do not use Cloudflare’s CDN. Its current overview describes lightweight JavaScript challenges that may use proof-of-work, proof-of-space, and browser or API probing to adapt the check to the visitor and browser.
Is Turnstile a CAPTCHA?
It serves the same broad purpose as a CAPTCHA—screening automated activity—but it is designed to reduce the need for visible puzzles. Cloudflare describes it as a CAPTCHA alternative. Depending on the configured widget mode and the result of its checks, visitors may see no prompt or, in Managed mode, a checkbox.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
- Computer captcha requirements I Am Not a Robot and click the submit button
- This Funny computer captcha design is perfect for any software engineers tech support, computer geek, programmer, developer, or network engineer on occasions like National Computer Security Day
- Standard fit offers a balanced silhouette that's not too loose or tight
- High-performance moisture-wicking material with UPF 50 protection
- Snag-resistant fabric technology helps reduce pulls and surface damage
Turnstile widget modes
| Mode | What the visitor sees | Useful distinction |
|---|---|---|
| Managed | A challenge runs automatically; a checkbox may appear depending on the assessment. | Balances automatic checks with an interactive fallback. |
| Non-Interactive | Challenges run without requiring visitor interaction. | Does not ask the visitor to complete an interactive challenge. |
| Invisible | The widget is hidden from the visitor. | Cloudflare’s widget documentation specifies a privacy-policy reference requirement for sites enabling this mode. |
Mode descriptions are based on Cloudflare’s widget documentation. The appropriate choice depends on how much visible interaction a site accepts and its policy requirements.
How does Cloudflare Turnstile work?
The browser-side widget obtains a response token. The website’s backend then sends that token and its secret key to Cloudflare’s Siteverify endpoint. The server should accept the protected action only after Siteverify confirms the token. Displaying a widget by itself is not sufficient: a client-only check can be bypassed by submitting a forged value.
Rank #2
- Computer captcha requirements I Am Not a Robot and click the submit button
- This Funny computer captcha design is perfect for any software engineers tech support, computer geek, programmer, developer, or network engineer on occasions like National Computer Security Day
- Relaxed fit with side seams offers a roomy, comfortable silhouette
- Soft-washed, garment-dyed US cotton fabric for a lived-in feel
- Register a widget. In Cloudflare’s Turnstile dashboard, create a widget and configure its allowed hostnames and mode.
- Add the client widget. Follow Cloudflare’s Get started guide to load and render the widget on the page where protection is needed.
- Send the response to your server. The browser submits the returned token with the form or action request. Treat it as untrusted until validated.
- Verify server-side. Your backend makes a POST request to
https://challenges.cloudflare.com/turnstile/v0/siteverify, supplying the secret key and response token, then acts on the verification result. - Keep the secret private. Store the secret only in server-side configuration; do not put it in page JavaScript or expose it to visitors.
Cloudflare’s token validation documentation says a token is at most 2,048 characters, valid for 300 seconds, and can be redeemed only once. Expired or previously redeemed tokens cannot be used as valid proof. Build the form flow so that a failed verification blocks or safely retries the protected action rather than silently accepting it.
Does Turnstile use cookies?
Cloudflare says Turnstile does not look for cookies such as login cookies and does not use cookies to collect or store information. That is not the same as saying it processes no data. Cloudflare also says the service examines session signals, including headers, user agent, and browser characteristics, as needed for security checks. Its overview says it processes data strictly necessary to provide security and does not access, store, or transmit communications, form entries, or other page inputs.
Rank #3
![WavePad Audio Editing Software - Professional Audio and Music Editor for Anyone [Download]](https://m.media-amazon.com/images/I/B1fcLEGCs6S.png._SL160_.png)
- Full-featured professional audio and music editor that lets you record and edit music, voice and other audio recordings
- Add effects like echo, amplification, noise reduction, normalize, equalizer, envelope, reverb, echo, reverse and more
- Supports all popular audio formats including, wav, mp3, vox, gsm, wma, real audio, au, aif, flac, ogg and more
- Sound editing functions include cut, copy, paste, delete, insert, silence, auto-trim and more
- Integrated VST plugin support gives professionals access to thousands of additional tools and effects
Cloudflare’s September 28, 2022 announcement describes Private Access Tokens as a way for Apple to validate device properties without Cloudflare itself collecting those data. These are Cloudflare’s descriptions of its product, not independent audit findings; the available sources do not establish comparative privacy performance against other CAPTCHA providers.
Privacy-policy requirement for Invisible mode
Cloudflare’s widget documentation says a site enabling Invisible mode must reference the Turnstile Privacy Addendum in its own privacy policy. The stated requirement is specific to Invisible mode; do not assume it applies identically to every mode.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is Cloudflare Turnstile free?
Cloudflare’s plans page, last updated August 14, 2026, lists a Free plan and an Enterprise plan. The limits below are Cloudflare’s published plan details, not independent service measurements.
| Plan | Price | Widgets per account | Hostnames per widget | Challenges | Analytics lookback | Other stated details |
|---|---|---|---|---|---|---|
| Free | Free | Up to 20 | Up to 10 | Unlimited | Up to 7 days | WCAG 2.2 AAA compliance |
| Enterprise | Contact sales | Unlimited | Up to 200 | Unlimited challenges, as listed on the plans page | Up to 30 days | Includes Ephemeral IDs and removal of Cloudflare branding |
These figures come from Cloudflare’s Turnstile plans page. Cloudflare said Managed mode became free for everyone for unlimited use when Turnstile reached general availability in 2023; the current plan limits above are the better guide to account, hostname, and analytics caps.
Best Value
What do Cloudflare’s usage figures tell you?
In a September 25, 2026 announcement, Cloudflare reported about three billion Turnstile verifications on a typical weekday. That is a vendor-reported usage figure, not independent evidence of detection accuracy or privacy performance. It shows that the service is used at substantial scale, but it does not establish how well it compares with another provider.
Similarly, Cloudflare’s April 1, 2022 claim of a 91% reduction in the number of CAPTCHAs it chose to serve over the prior year referred to its own challenge system. It was not an independent success rate for Turnstile.
When should a site choose Turnstile?
Turnstile is a practical option when a website needs a bot-screening step, wants to avoid routinely presenting puzzle challenges, and can implement server-side token verification. Before deployment, decide which widget mode fits the user experience, check whether the Free plan’s widget and hostname caps fit the site, and account for the privacy-policy requirement if using Invisible mode.
The cited Cloudflare sources describe Turnstile’s capabilities and privacy handling from the provider’s perspective. They do not provide independent comparative testing against Google reCAPTCHA or other vendors, so claims that Turnstile is categorically more accurate or more private than a competitor are not established here.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
