Turnstile is free. So why would you pay for a captcha?

First, the thing that disqualifies half the arguments you will read about this

A lot of "Turnstile alternative" pages — including ones published by captcha vendors — argue that Turnstile puts a US company in your request path. It does. So do we.

botshield.dev is served through Cloudflare. Cloudflare terminates TLS for every verification request and sees your visitor's IP address. Our origin server is a bare-metal machine in Helsinki, but the edge is anycast, so we will not tell you which country handled any given request. If a vendor's argument against Turnstile is "Cloudflare is in the path", that argument does not distinguish us from Turnstile, and we are not going to pretend it does.

What is left after you throw that argument away — and after conceding the volume arithmetic above — is three real differences, and they are all things you can check.

1. Turnstile is a Cloudflare product, and that has a shape

Turnstile is free because it is part of a business that sells you other things. That is not a criticism; it is a very good deal. But it has consequences worth knowing before you build on it:

• It needs a Cloudflare account. Turnstile is configured in the Cloudflare dashboard, so using it means having that relationship, and the free tier's limits are set by a product strategy that is not about captchas.
• You are reasoning about one vendor for several things at once. If you are already all-in on Cloudflare, that is a feature. If you have been deliberately spreading your dependencies, it is the opposite.
• Analytics on the free plan last 7 days, per Cloudflare's plans page; 30 days on Enterprise. Our pricing page commits to the opposite shape: "Every plan includes invisible mode, proof-of-work verification and the dashboard."
• Removing Turnstile's branding is an Enterprise feature, per the same page. Our free plan lists a "basic widget" rather than the appearance controls on the paid tiers, so check the widget looks the way you need before you decide this one matters.

Our side of this is not "we are more independent". We sit behind Cloudflare too. It is that the captcha is the whole of our product rather than a feature of something larger, which means the thing you are buying is the thing we work on.

2. What you can read, and what you can check

This is the difference that actually matters to the reader who pays.

The "what the vendor publishes" row is published vendor wording, not an audited fact — ours included. Turnstile's rows are quoted from Cloudflare's Turnstile plans and documentation pages, read 8 October 2026.

Here is our half of that row as commands rather than as a sentence:

# No cookie is set, by either URL the widget uses:
curl -sD - -o /dev/null https://botshield.dev/sdk.min.js | grep -i set-cookie
curl -sD - -o /dev/null -X POST https://botshield.dev/api/v1/solve | grep -i set-cookie

# No client-side storage, no fingerprinting:
curl -s https://botshield.dev/sdk.js > sdk.js
grep -c -E 'document\.cookie|localStorage|sessionStorage|indexedDB|canvas|navigator\.userAgent|navigator\.plugins|AudioContext|WebGL|getBattery|screen\.width' sdk.js

# Every host the widget contacts:
grep -o -E 'https?://[a-zA-Z0-9./_-]+' sdk.js | sort -u

Measured 9 October 2026: no Set-Cookie header on either URL, zero matches for all eleven APIs, and exactly one host — botshield.dev, on /api/v1/challenge and /api/v1/solve.

There is a third endpoint, /api/v1/verify. Your server calls it with your secret key after the form is submitted; the visitor's browser never touches it. It is in our documentation and we would rather point at it than have you find it and wonder what else we skipped.

Run the commands. Four lines, under a minute. A privacy claim you verified yourself is worth more than one either of us puts in a badge — and it is the one thing on this comparison that the free option cannot offer you, because you cannot read what is not published.

3. Proof-of-work is a different trade, and you may prefer the other side of it

Turnstile decides whether you look like a person. BotShield asks your browser to do a small piece of arithmetic. Neither is strictly better:

• Turnstile's way is invisible more often, because it leans on signals Cloudflare already has about the connection.
• Proof-of-work costs the visitor a few hundred milliseconds of CPU and asks nothing about who they are. There is nothing to store because the person is not what is being assessed.
• On a phone with a weak processor, proof-of-work is the slower of the two. Say that out loud when you choose.

If you have ever had to explain a captcha to a privacy officer, the second row is the one that shortens the conversation. If you have never had that conversation, the first row wins.

4. The three situations where €19 beats free

Note what is not on this list: volume, hostnames and price. Turnstile wins all three and we said so at the top.

1. You need to show someone how it works. "Proof-of-work, here is the widget source, here is the server source, here are the four commands" is a two-minute answer to a privacy officer. "Cloudflare's proprietary challenge selection" is a procurement thread, and you will be the one sitting in it.
2. You want the mechanism not to depend on recognising the visitor. That is the whole of the proof-of-work argument, and it is the only one of the three that is about the product rather than the arrangement.
3. You are deliberately not consolidating on Cloudflare. Some buyers have a reason — a client policy, a dependency-spreading rule, an incident they remember. This is a weaker version of that reason than it was before you read section one of this page, because we are behind Cloudflare too. But there is a real difference between your captcha being a product of the company that also fronts your origin and your captcha vendor renting that company's edge. How much that difference is worth to you is not something we can tell you.

And the four where it does not

• You need volume or a lot of hostnames. Unlimited challenges across up to 200 hostnames, free, against 10,000 solves and 10 domains at €19. This is not close.
• One site, already on Cloudflare, nobody asking questions. Turnstile. Free. Done.
• You need a signed DPA this quarter. We do not have one — our privacy policy says so under a heading reading "what we have not yet verified, we are not claiming". Cloudflare has an enterprise legal apparatus and we have four strings and a changelog.
• You need an uptime commitment. We publish none. If a number in a contract is what you need, buy from someone who publishes one.

Start on the free plan

1,000 solves a month, 2 domains, no card — and invisible mode included on the free plan rather than reserved for a paid one, so you are testing the thing you would actually buy. Put it on one real form. If Turnstile was the right answer, you will know within the hour, and you will not have spent anything finding out.

Start free