# Cap vs Cloudflare Turnstile

Turnstile is Cloudflare's free CAPTCHA replacement, focused on running invisible challenges that lean heavily on Cloudflare's network signals and browser fingerprinting.

## Quick verdict

Turnstile is genuinely good if you're already on Cloudflare and accept that the verdict is theirs to make. Cap is the better fit when you want self-hosting, deterministic difficulty, no third-party dependency, and the ability to override decisions for your own users.

## Where Turnstile makes sense

- You're already routing traffic through Cloudflare and want to stay in one ecosystem.  
- You don't want to host anything — Turnstile is fully managed.  
- You're willing to accept Cloudflare's algorithmic decisions for "suspicious" visitors with no way to override.

## Where Cap is the better choice

- **Self-hosted.** Cap runs on your servers. Turnstile requires every challenge to round-trip through Cloudflare.  
- **You own the policy.** With Turnstile, if Cloudflare's algorithm decides a user looks suspicious — common for Brave, Librewolf, Tor, or VPN users — there is no override. Cap puts the difficulty knob in your hands.  
- **Lower error rate for privacy-conscious users.** Turnstile is widely reported to misclassify hardened browsers. Cap's proof-of-work doesn't care about fingerprints.  
- **Open source.** Apache 2.0 vs Turnstile's closed-source client and server.  
- **No telemetry.** Cap doesn't phone home and doesn't set cookies. Turnstile's client communicates with `challenges.cloudflare.com` on every page load.  
- **Customizable.** Cap exposes CSS variables for colors, size, and shape. Turnstile's iframe is mostly fixed.

## Where they're similar

Both ship a small (~20–110 KB) client. Both run an "invisible" mode (Cap calls it [floating mode](https://trycap.dev/guide/floating.html) or [programmatic mode](https://trycap.dev/guide/programmatic.html)). Both layer behavioral checks on top of a primary challenge — Cap calls those [instrumentation challenges](https://trycap.dev/guide/instrumentation.html), Turnstile calls them "managed challenges."

## Migration

Cap's `/siteverify` API shape is compatible with Cloudflare's `siteverify`, so server-side verification is mostly a URL and secret swap. The client-side change is replacing `<div class="cf-turnstile">` with `<cap-widget>` and pointing it at your Cap instance — see the [quickstart](https://trycap.dev/guide/) for full code.