Cloudflare Turnstile vs reCAPTCHA: Which to Use

Cloudflare Turnstile vs reCAPTCHA comes down to one design difference: Turnstile gives the site a pass-or-fail token and tries never to show a puzzle, while reCAPTCHA either shows a challenge (v2) or hands the site a risk score to act on (v3). Turnstile is simpler to run and usually invisible; reCAPTCHA gives a site more signal to build its own rules on. We run CaptchaNo, which solves both for authorised automation, so we have no stake in which one you install — this comparison uses each vendor's own documentation, checked in October 2026. If you want the internals of Cloudflare's widget first, read how Turnstile works.

The short answer

Choose Turnstile if you want a low-friction check with little to tune. Choose reCAPTCHA v3 if you want a score to feed your own risk logic, or reCAPTCHA's paid tiers if you need reason codes and account-level fraud features. Both stop casual automation; neither is a complete bot-management system on its own.

Side by side

Sources: Cloudflare's Turnstile validation docs and plans page; Google's verification docs and tier comparison.

How each one decides

Turnstile runs checks in the browser — Cloudflare describes proof-of-work, browser signals and, where available, Private Access Tokens — and returns a token if they pass. The site's server sends that token to Cloudflare's Siteverify API and gets a yes or no. There is no score to tune, which is the point: Cloudflare makes the call.

reCAPTCHA v3 grades the interaction and returns a score with the token; the site picks a threshold and decides what each score means. reCAPTCHA v2 works more like Turnstile from the site's side — the token is valid or not — but is more willing to put an image challenge in front of a person it doubts. We explain the scale in detail in what a reCAPTCHA v3 score means.

User experience and accessibility

Turnstile aims never to show a puzzle. In managed mode a visitor sees at most a checkbox, and Cloudflare's widget can be set to appear only when interaction is needed. reCAPTCHA v3 is equally invisible, but v2 can escalate to image grids, which are slow on mobile and hard for people with visual impairments; v2's audio alternative helps but is not a full answer. If your audience includes many VPN, privacy-browser or assistive-technology users, expect both systems to treat some of them as riskier, because both rely on browser and network signals.

Privacy

Cloudflare positions Turnstile as privacy-preserving and states that it does not access, store or transmit form entries or other page inputs. Google's reCAPTCHA terms and privacy policy apply to reCAPTCHA, and many site owners in the EU treat it as requiring consent. We are not giving legal advice: if privacy law matters for your site, read each vendor's data-processing terms with your counsel rather than relying on a comparison article — including this one.

Detection and control

reCAPTCHA gives the site more to work with. A score lets you route borderline traffic to a second check instead of blocking it, and paid tiers add reason codes such as automation or unexpected usage patterns, plus account-level fraud features. Turnstile gives a binary verdict and leaves the risk decision to Cloudflare. Vendor articles in this space claim one or the other "catches more bots", but none we read published a method we could reproduce, so we make no detection-rate claim here.

How common each one is

reCAPTCHA is still far more widespread. Web-technology tracker wmtips reports reCAPTCHA as roughly four times as popular as Turnstile across the 3.8 million-plus sites it analyses. Turnstile is newer — Cloudflare announced the open beta in September 2022 — and adoption is growing.

Switching from reCAPTCHA to Turnstile

Cloudflare offers a compatibility mode, loaded with ?compat=recaptcha, that lets Turnstile stand in for an existing reCAPTCHA integration — but its migration guide says compatibility currently goes only up to reCAPTCHA v2. Moving from v3 means replacing score logic with Turnstile's pass/fail, so plan where your borderline-score handling goes before you switch.

What changes for automation

For authorised automation, the two behave differently in one important way: a Turnstile token lasts five minutes and a reCAPTCHA token two, so reCAPTCHA leaves less room between solving and submitting. Both are single-use, both are judged against the session that submits them, and both put their token in a hidden form field — cf-turnstile-response for Turnstile and g-recaptcha-response for reCAPTCHA. Our tutorials cover both: Turnstile in Puppeteer and reCAPTCHA v2 in Playwright. CaptchaNo solves Turnstile and reCAPTCHA through the same API call, so switching widgets on a target site means changing one field.

Frequently Asked Questions

Is Cloudflare Turnstile better than reCAPTCHA?

It depends on what you need. Turnstile is simpler, rarely shows a puzzle and needs no threshold tuning, so it suits most forms. reCAPTCHA v3 returns a risk score you can build your own rules on, and its paid tiers add reason codes and fraud features. Pick the one whose output fits how you want to make decisions.

Is Cloudflare Turnstile free?

Yes for most sites. Cloudflare's plans page lists the free plan with unlimited challenges, up to 20 widgets and up to 10 hostnames per widget, and it does not require your site to use Cloudflare's network. An Enterprise plan adds more widgets, hostnames and features for larger organisations.

Can Turnstile replace reCAPTCHA without code changes?

Partly. Cloudflare's compatibility mode lets Turnstile stand in for an existing reCAPTCHA v2 integration, but Cloudflare says compatibility currently stops at v2. Sites using reCAPTCHA v3 scores have to replace their score handling, because Turnstile returns pass or fail rather than a score.

How long do Turnstile and reCAPTCHA tokens last?

A Turnstile token is valid for 300 seconds and a reCAPTCHA token for two minutes, according to each vendor's documentation. Both can be verified only once, and an expired or reused token fails with a timeout-or-duplicate error. Generate the token as close as possible to the request that submits it.

Do Turnstile and reCAPTCHA work without Cloudflare or Google hosting?

Yes. Turnstile can be embedded on any website without routing traffic through Cloudflare, and reCAPTCHA has always worked on any site. Each loads a script from its vendor and verifies tokens through the vendor's API, so both need the visitor's browser and your server to reach those endpoints.

Solve either one with one API

Start a free CaptchaNo trial and handle Turnstile and reCAPTCHA in your authorised automation with the same request shape, billed only on success. See pricing for per-type rates.