Comparison
CaptchaKit vs Cloudflare Turnstile: when does a game beat a checkbox?
Short answer
Cloudflare Turnstile is a free CAPTCHA alternative with unlimited challenges, up to 20 widgets and invisible or non-interactive modes. CaptchaKit is a game-based CAPTCHA that is pay what you want, one time, with lifetime access and unlimited domains. Pick Turnstile when you want no visible step, and CaptchaKit when you want the challenge to match your brand.
Side by side
CaptchaKit and Cloudflare Turnstile. Plans as of October 2026.
| Feature | CaptchaKit | Cloudflare Turnstile |
|---|---|---|
| Price | Pay what you want, one time. Business $29 a month. | Yes Free plan. Enterprise by contacting sales. |
| Challenge mode | Yes Arcade game: 18 to choose from, optional in-widget switcher | Managed (may show a checkbox), non-interactive, or invisible |
| Widget limits | Yes Lifetime access, unlimited domains | Free: up to 20 widgets, 10 hostnames per widget. Enterprise: up to 200 hostnames per widget. |
| Challenge volume | No per-challenge fee on the pack | Yes Unlimited challenges on Free |
| Branding | Yes Pick from 18 arcade games per form | Removing Cloudflare branding is an Enterprise feature |
| Analytics | Paid add-on Business, $29 a month: solve rates, bot blocks, per-game charts | 7-day analytics on Free, 30-day on Enterprise |
| Accessibility | Yes In-widget question link plus keyboard play | Cloudflare states Turnstile is WCAG 2.2 AA compliant |
| Privacy statement | Yes No advertising or tracking cookies (privacy policy) | Cloudflare says it processes only the data strictly necessary |
| Server-side check | POST /api/verify, signed JWT, 10 minutes, single use | Siteverify |
The short version
Cloudflare describes Turnstile as a smart CAPTCHA alternative that works without proxying traffic through Cloudflare. The Free plan lists unlimited challenges, up to 20 widgets and 10 hostnames per widget. If your goal is the least visible bot check possible at no cost, Turnstile is the benchmark to beat.
CaptchaKit solves a different problem. Some sites want the check to be seen, and want it to look like part of the site. For them, a ten-second game is a feature, not a tax.
Three Turnstile modes and one CaptchaKit idea
Turnstile widgets run in managed mode, which may show a checkbox, non-interactive mode, or invisible mode. Cloudflare picks how much to ask of the visitor. That is useful when you want fewer interruptions and are happy to let the service decide.
CaptchaKit always asks the visitor to do something small. A visitor sees one of 18 games: Connect 4, Color Match, Skee-Ball, Hoops and more, each with a listed average play time from 6 to 20 seconds. You choose the game per form or let visitors switch inside the widget if you own more than one. Try Tap in Order, the 6-second one.
Limits and price
On Free, Turnstile caps you at 20 widgets per account and 10 hostnames per widget, and the plans page lists no Cloudflare branding removal. Enterprise moves to up to 200 hostnames per widget, any-hostname widgets, ephemeral IDs, offlabel and 30-day analytics. Enterprise pricing is by contacting sales.
CaptchaKit's pricing is pay what you want, one time, for the full pack or a single game, with lifetime access and unlimited domains. Business is $29 a month if you need analytics, signed webhooks, team seats, two-factor auth, audit logs, data export and priority support.
Honest read: for most single sites, Turnstile's limits are generous and its price is zero. CaptchaKit's pitch is not lower cost. It is a challenge that looks intentional and a price you set once.
Accessibility and privacy
Cloudflare states that Turnstile is WCAG 2.2 AA compliant, and the plans page lists WCAG 2.2 AAA compliance. That is the vendor's statement, so verify it on your own pages.
CaptchaKit offers an in-widget "Can't play? Accessible check" link that switches to a screen-reader-friendly question and issues the same pass token. All games are playable from the keyboard, and progress is announced through live regions.
On privacy, Cloudflare says Turnstile processes only the data strictly necessary and does not access form entries. CaptchaKit's privacy policy says no advertising or tracking cookies are used, that it receives only the game outcome and a timestamp from your visitors, and that server logs including IP addresses are kept up to 90 days.
Where Turnstile is a good fit
Turnstile is a good fit for high-volume forms where you want zero visual friction, for teams already inside the Cloudflare ecosystem, and for anyone who wants a free plan with unlimited challenges. Its invisible mode suits checkouts and logins where an extra step costs more than it protects.
It also has a smaller learning curve: it is a standard widget plus a Siteverify call, and Cloudflare publishes an extensive documentation set.
Where CaptchaKit is a good fit
CaptchaKit is a good fit when the form is a brand moment: a game studio's signup, a ticketing site's checkout, a community site's comments. See the docs for the integration, and the WordPress plugin for a no-code install.
Three scenarios
A personal blog with a contact form: Turnstile's free plan and invisible mode fit well. You will not hit 20 widgets, and no visitor sees a challenge. A CAPTCHA game would be more than the site needs.
A game studio's newsletter signup or a ticketing site's account page: a game fits the audience and can use your colors. CaptchaKit's Penalty Kick and Hoops are listed for sports and ticketing sites.
An agency running dozens of client sites: Turnstile's Free plan caps at 20 widgets per account, so count your sites. CaptchaKit's lifetime access covers unlimited domains. Check both vendors' terms for agency use.
Questions
Is Cloudflare Turnstile free?
Yes. The Free plan lists unlimited challenges, up to 20 widgets, 10 hostnames per widget and 7 days of analytics (checked October 2026).
Do I need to use Cloudflare for Turnstile?
Cloudflare says Turnstile works without proxying your traffic through Cloudflare.
Is CaptchaKit visible to users?
Yes. It shows a short arcade game. Choose Turnstile's invisible mode if you want no visible step.
Can I remove branding?
On Turnstile, removing Cloudflare branding (offlabel) is an Enterprise feature. With CaptchaKit you pick which of the 18 games appears on each form.
Which one is better for WordPress?
Both have WordPress options. CaptchaKit's plugin covers login, registration, comments and WooCommerce checkout. See the best CAPTCHA for WordPress and WooCommerce.
How do I verify tokens?
Turnstile uses Siteverify. CaptchaKit uses POST /api/verify with a Bearer API key, as shown in how to verify a CAPTCHA token.
Can I use both on one site?
You can use different tools on different forms, for example invisible protection on checkout and a game on signup. Avoid stacking two challenges on the same form.
Sources
- Cloudflare Turnstile plans (checked 2026-10-17)
- Cloudflare Turnstile docs (checked 2026-10-17)
- CaptchaKit documentation (checked 2026-10-17)
- CaptchaKit pricing (checked 2026-10-17)
- CaptchaKit privacy policy (checked 2026-10-17)
- CaptchaKit on WordPress.org (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.