How Cloudflare Turnstile Works

Cloudflare Turnstile is a CAPTCHA replacement that verifies users without image challenges. It uses browser-level signals like Private Access Tokens, JavaScript execution challenges, and behavioral analysis to determine if a visitor is human.

Launched in 2022, Turnstile is designed to be privacy-preserving — it does not track users across sites or use cookies for fingerprinting.

How Turnstile verification works

1. Widget loads — The site includes challenges.cloudflare.com/turnstile/v0/api.js with a sitekey
2. Browser challenges run — Turnstile executes lightweight JavaScript challenges in the background
3. Signals collected — Browser environment, execution timing, and hardware signals are analyzed
4. Token generated — If the browser passes, Turnstile generates a cf-turnstile-response token
5. Backend verification — The site sends the token to Cloudflare's siteverify endpoint
6. Response returned — Cloudflare confirms the token is valid and returns a success/failure response

User visits page
      ↓
Turnstile JS loads
      ↓
Background challenges run (< 1 second)
      ↓
Token generated → sent to site backend
      ↓
Backend calls siteverify → Cloudflare confirms
      ↓
User gains access

Turnstile widget modes

Most sites use managed mode, where Turnstile shows a brief loading spinner and then auto-completes without user interaction.

What Turnstile checks

Unlike reCAPTCHA, Turnstile does not analyze mouse movement or page interactions. Instead, it focuses on:

Turnstile vs reCAPTCHA

Turnstile vs Cloudflare Challenge

These are different products:

Finding Turnstile on a page

Look for these indicators:

<!-- Script tag -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js"></script>

<!-- Widget container -->
<div class="cf-turnstile" data-sitekey="0x4AAAAAAAD..."></div>

<!-- Or explicit render -->
<script>
  turnstile.render('#container', {
    sitekey: '0x4AAAAAAAD...',
    callback: function(token) { /* handle token */ }
  });
</script>

The sitekey always starts with 0x4 followed by alphanumeric characters.

Solving Turnstile with CaptchaAI

import requests
import time

response = requests.get("https://ocr.captchaai.com/in.php", params={
    "key": "YOUR_API_KEY",
    "method": "turnstile",
    "sitekey": "0x4AAAAAAAD...",
    "pageurl": "https://example.com/login",
    "json": 1
})

task_id = response.json()["request"]

for _ in range(30):
    time.sleep(5)
    result = requests.get("https://ocr.captchaai.com/res.php", params={
        "key": "YOUR_API_KEY", "action": "get", "id": task_id, "json": 1
    }).json()
    if result.get("status") == 1:
        token = result["request"]
        print(f"Turnstile token: {token[:50]}...")
        break

FAQ

Does Turnstile work without JavaScript?

No. Turnstile requires JavaScript to execute its browser challenges. Noscript browsers will fail.

Can Turnstile be used on non-Cloudflare sites?

Yes. Unlike Cloudflare Challenge pages, Turnstile is a standalone widget that any website can embed — the site does not need to use Cloudflare as its DNS/CDN provider.

Does Turnstile use cookies?

Turnstile may set a cf_clearance-like cookie in some configurations, but it does not use third-party tracking cookies like Google's reCAPTCHA.

How fast is Turnstile verification?

For real users, typically under 1 second. Most users never see any visible widget. Solving via CaptchaAI takes 10–20 seconds.

Related guides

• How to Solve Cloudflare Turnstile Using API
• Cloudflare Turnstile Errors and Troubleshooting
• How Cloudflare Challenge Works
• Cloudflare Turnstile vs reCAPTCHA