A comparison of two products that are not ours. Turnstile is the better of the two for most sites — and both share a limitation that no amount of refinement fixes.
If you have decided you want a challenge widget, this is a real choice worth getting right. We sell something different, so treat the final section as the pitch it is — everything before it is our honest read of two competitors' products.
| Cloudflare Turnstile | Google reCAPTCHA | |
|---|---|---|
| Visible challenge | Rare; usually a silent pass | v2 checkbox or image grid; v3 scores silently |
| Privacy posture | Positioned as privacy-preserving; not ad-funded | Documented as collecting extensive browser signal |
| Cost | Free for standard use, no Cloudflare account required | Free tier; paid Enterprise tier |
| Accessibility | Better, because it challenges less often | Documented barrier when it escalates |
| Decides | Before submission, on session signals | Before submission, on session signals |
| Reads the submission | No | No |
| Record of who it turned away | No | No |
It interrupts people far less. Most visitors get a silent pass rather than a puzzle. Given that image challenges are the ones users rate as annoying — the UC Irvine study of reCAPTCHAv2 found exactly that split, with image tasks rated annoying and checkbox tasks easy — showing the challenge less often is the single biggest usability improvement available inside this category.
The privacy story is cleaner. Google's system has been documented as collecting substantial browser and behavioural signal, and the same UC Irvine study characterised reCAPTCHAv2 as functioning substantially as a tracking and data-collection mechanism. If your GDPR posture is what is driving this decision, that difference is likely to settle it on its own.
It does not require you to be a Cloudflare customer, which makes it a straightforward swap rather than a platform commitment.
Maturity and integration coverage. Nearly every form builder, CMS plugin and framework has a reCAPTCHA integration that has existed for a decade. If your stack has a reCAPTCHA option and no Turnstile option, that is a real cost of switching.
Enterprise tooling. Google's paid tier offers analysis and controls that a free product does not attempt to match.
That is close to the whole list, and it is notably not about protecting your form better.
Both decide before a submission exists. They evaluate a session, hand your server a token, and take no further part. That has three consequences:
If you want a challenge widget, choose Turnstile. Better privacy, less friction, no cost, no lock-in. Migrating from reCAPTCHA is usually an afternoon.
Do not run both, and do not stack either on top of another form-level system. Two gates give you the friction of the stricter and the accuracy of neither. Network-level bot management at your CDN is a different layer and composes fine.
SpamKill is not a third option in this category — it works at the other end of the transaction. Detection happens after capture, scoring how the submission was actually composed rather than whether a session passed a test, at 99.9% accuracy across more than 100M+ submissions screened for 1,500+ businesses. There is no widget for a visitor to pass, and every held submission is reviewable rather than silently discarded, which is the specific gap both products above share. From $29/month with a 30-day free trial, no credit card. If you would rather just use Turnstile, that is a reasonable choice and we have said so above.
For the visitor, usually yes — it shows a puzzle far less often and does not monetise the interaction as ad-tech signal. Architecturally it is the same shape: a third-party widget that decides whether a session looks human before the form is submitted, and hands your server a token. The improvement is real and it is an improvement within the category, not a departure from it.
Cloudflare offers Turnstile at no cost for standard use and does not require you to be a Cloudflare customer. Check their current terms before you plan around it — pricing and limits are theirs to change, and any figure quoted on a third-party page like this one ages badly.
Turnstile, fairly clearly. Google's reCAPTCHA has been documented as collecting substantial browser and behavioural signal, and the UC Irvine study of reCAPTCHAv2 characterised it as a data-collection mechanism as much as a security one. Turnstile is positioned explicitly as the privacy-preserving alternative. If GDPR posture is driving the decision, that difference is the decision.
No, and this is the structural point both share. Both decide before a submission exists, based on the session rather than the content or the composition of the form fill. A bot that passes the widget submits whatever it likes, and neither system ever looks at what it sent.
On the same form, we would not. Two gates give you the friction of the stricter one and the accuracy of neither, because each sees only part of the picture. Network-level bot management at your CDN is a different layer and composes fine with a form-level system.
Paste your form HTML into the Form Transformer and compare what a person receives with what an automated filler receives.
Open the Form Transformer