How do you prove a user is human without making them click traffic lights for two minutes?
Traditional CAPTCHAs hurt your conversion rate, annoy real users, and increasingly get solved by cheap third-party services. Visually impaired users are punished disproportionately. And the popular alternatives ship browsing data to ad-tech companies. You need something that proves humanity without the friction — and without selling out your visitors.
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
How Cloudflare solves it
- Invisible challenges for most users. Turnstile evaluates browser signals (TLS fingerprint, canvas, behavioral hints) and silently passes the vast majority of real visitors. They never see a checkbox, never solve a puzzle.
- Privacy-first by design. No tracking cookies, no fingerprinting that follows users across sites, no ad-tech monetization. Cloudflare doesn't need (or want) your visitors' data.
- Drop-in replacement for reCAPTCHA. Same widget-on-page + server-side verify flow. Migration is typically a couple of hours: swap the script tag and update your verify endpoint.
- Works on any site, not just Cloudflare. Turnstile is free and works on any origin — Cloudflare-hosted or not. Use it on forms, sign-ups, login screens, comment boxes, password resets.
- Server-side verification. Every token is verified against Cloudflare's siteverify endpoint before you trust it. Tokens are single-use and expire fast, preventing replay.
Common questions
Is Turnstile really free, even at high volume?
What if a visitor still gets challenged? What do they see?
Does Turnstile prevent every bot?
Can I use Turnstile on a mobile app?
Try it live
Pick a scenario below to open a mock login page under that outcome. Each one uses one of Cloudflare's public test sitekeys, verified against the real siteverify endpoint on the server — the site itself never sees or chooses the key.
Turnstile's outcome depends on what its risk signals say about the visitor. Pick a scenario below to open a mock login page pre-wired to Cloudflare's public test keys for that outcome — each one shows what a real visitor would actually see.
Trusted human
Browser signals look normal. The challenge runs invisibly and the widget shows a green check almost immediately — no interaction needed.
Open as a human →Suspicious visitor
Turnstile isn't sure and presents an interactive checkbox challenge. Solve it and the widget still passes — login proceeds normally.
Open as suspicious →Confirmed bot
Turnstile classifies the session as automated and never issues a token. The widget shows its own failure state and login stays disabled — nothing reaches the server.
Open as a bot →