Turnstile

What is the challenge?

How do you prove a user is human without making them click traffic lights for two minutes?

Traditional CAPTCHAs hurt your conversion rate, annoy real users, and increasingly get solved by cheap third-party services. Visually impaired users are punished disproportionately. And the popular alternatives ship browsing data to ad-tech companies. You need something that proves humanity without the friction — and without selling out your visitors.

Architecture

How it fits together

Diagram coming soon

Architecture diagram for this solution will be added here.

Cloudflare's Solution

How Cloudflare solves it

Invisible challenges for most users. Turnstile evaluates browser signals (TLS fingerprint, canvas, behavioral hints) and silently passes the vast majority of real visitors. They never see a checkbox, never solve a puzzle.
Privacy-first by design. No tracking cookies, no fingerprinting that follows users across sites, no ad-tech monetization. Cloudflare doesn't need (or want) your visitors' data.
Drop-in replacement for reCAPTCHA. Same widget-on-page + server-side verify flow. Migration is typically a couple of hours: swap the script tag and update your verify endpoint.
Works on any site, not just Cloudflare. Turnstile is free and works on any origin — Cloudflare-hosted or not. Use it on forms, sign-ups, login screens, comment boxes, password resets.
Server-side verification. Every token is verified against Cloudflare's siteverify endpoint before you trust it. Tokens are single-use and expire fast, preventing replay.

FAQ

Common questions

Is Turnstile really free, even at high volume?

Yes, free for everyone. Cloudflare uses Turnstile to improve its own bot detection (and the broader internet's), so it's offered at no cost regardless of traffic volume.

What if a visitor still gets challenged? What do they see?

A simple managed challenge (a brief 'verifying you are human' spinner) or an interactive challenge for the most suspicious sessions. Far less intrusive than a Google CAPTCHA — no image grids, no audio puzzles, no 'select all crosswalks.'

Does Turnstile prevent every bot?

No tool does — but Turnstile catches the vast majority of common bot traffic against forms and login flows, especially when paired with rate limiting and Bot Management. For high-stakes endpoints (account creation, password reset), most customers stack Turnstile + bot scores + rate limiting.

Can I use Turnstile on a mobile app?

Yes — Turnstile supports webview-based mobile flows and provides a JS API your native wrapper can call into. There's also a server-to-server attestation API for fully native flows.

Let's Test!

Try it live

Submit the form below. Your Turnstile token is verified against Cloudflare's siteverify endpoint on the server. The site key on this page is Cloudflare's public demo key; in production you'd use your own.

Fill out the form below. The Turnstile widget issues a token; on submit, the server calls Cloudflare's siteverify endpoint to confirm the token before accepting the submission. The site key is loaded from the server config so it can be rotated without rebuilding.

Dive Deeper

How do you prove a user is human without making them click traffic lights for two minutes?

How it fits together

How Cloudflare solves it

Common questions

Try it live

Docs & blogs

Documentation

Blogs