Skip to content
Shield

Compare

How Shield compares

Free like Turnstile, scored like reCAPTCHA v3, private like Friendly Captcha. Here's how it stacks up against every mainstream alternative, including where they're the better pick.
Start migratingJump to the table

The honest version

When something else is the better choice

Shield is young. Every provider below has strengths we don't match, and you should know them before you switch.

  • You're all-in on Cloudflare

    Turnstile's detection draws on a very mature network, and it's already in your dashboard. If you don't need a score or data independence, it's a fine default.

  • You need Google's dataset

    reCAPTCHA's training data is vast. If your fraud tooling already depends on Google's signals, the trade-offs may be worth it.

  • You want an established vendor

    hCaptcha is a mature enterprise product with reCAPTCHA-compatible APIs and a long track record.

  • EU hosting is a hard requirement

    Friendly Captcha is EU-hosted and privacy-first. Shield stores no visitor data at all, but if hosting location is the rule, check it.

Feature by feature

The full comparison

Edge Shield compared with Cloudflare Turnstile, Google reCAPTCHA, hCaptcha and Friendly Captcha
TurnstilereCAPTCHAhCaptchaFriendly Captcha
PriceFree, unlimitedFreeFree to 10k/moFree tierPaid (free non-commercial)
Confidence score1–100, every call0.0–1.0 (v3)Enterprise only
Visual puzzlesNeverNeverv2 fallbackYesNever
Invisible modev3Paid
Proof-of-work challengesPartial
No ad-tech tracking
No per-visitor data stored
Offline token verification (JWKS)
Report-only (shadow) mode
Test keys for CITest mode
Open-source widget
Independent of big-cloud ecosystems
Turnstile-compatible siteverifyPartial
Works without account lock-inCloudflare accountGoogle account

Competitor capabilities and pricing from publicly available information at the time of writing; they may change.

What actually sets Shield apart

Four differences that outweigh any checkbox

  • A score, not just a verdict

    Graduated decisions: approve people, step up the uncertain, route good agents to your API, block abuse.

  • Nothing to leak

    Signals are scored in memory and discarded. Only hourly aggregates persist, so compliance is a non-event.

  • No lock-in

    A standalone service. No traffic routed through us, and a Turnstile-compatible format makes leaving as easy as arriving.

  • Built to be unnoticeable

    Under 15KB, dependency-free, solved in a Web Worker. No layout shift and no main-thread jank.

Provider by provider

Strengths, limits and the difference

Shield vs Cloudflare Turnstile

The CAPTCHA alternative that made invisible verification mainstream, free within the Cloudflare ecosystem.

Where it's strong

  • Free
  • No visual puzzles
  • Mature bot detection
  • Managed, non-interactive and invisible modes

Where it falls short

  • No confidence score exposed
  • Requires a Cloudflare account
  • Closed-source widget
  • Stores per-visitor data

The Shield difference: Shield matches Turnstile's modes and siteverify format, then adds a 1–100 score, an open-source widget and no per-visitor data. Migration is a URL and key swap.

Shield vs Google reCAPTCHA

The incumbent. v2 shows image puzzles; v3 scores traffic invisibly, with Google's tracking along for the ride.

Where it's strong

  • Huge training dataset
  • v3 exposes a score
  • Familiar to every developer

Where it falls short

  • Ad-tech tracking concerns
  • Image puzzles in v2 frustrate users
  • Free tier capped at 10,000 assessments a month
  • GDPR and accessibility burden

The Shield difference: Shield gives you what v3's score offers without the tracking, the puzzles or the assessment cap, and without wiring Google into every page.

Shield vs hCaptcha

A privacy-focused reCAPTCHA alternative that still leans on visual puzzles.

Where it's strong

  • Privacy-friendlier than reCAPTCHA
  • Drop-in reCAPTCHA compatibility
  • Established enterprise product

Where it falls short

  • Shows image puzzles to real users
  • Invisible mode is a paid feature
  • Score reserved for Enterprise
  • Closed-source widget

The Shield difference: Shield never shows a puzzle; verification is proof-of-work plus signals, not human labelling. Invisible mode and the score are free for everyone.

Shield vs Friendly Captcha

A European, privacy-first CAPTCHA built on proof-of-work. Philosophically the closest to Shield.

Where it's strong

  • Genuinely privacy-first
  • Proof-of-work based
  • No puzzles
  • EU-hosted

Where it falls short

  • Paid for commercial use
  • No confidence score
  • No adaptive managed mode
  • Smaller detection surface

The Shield difference: Shield takes the same privacy-first, proof-of-work approach, makes it free for commercial use, and adds adaptive risk scoring and a humanity score.

Migration

Arriving takes minutes. Staying is optional.

On Turnstile, the siteverify response is identical. On reCAPTCHA or hCaptcha, the widget drops into the same place on your forms.
Turnstile migration guideMigrating from reCAPTCHA
  1. 01

    Create a widget in shadow mode

    Run it beside your current CAPTCHA. Nothing is blocked; analytics show what Shield would have done.

  2. 02

    Swap the snippet and siteverify URL

    With data-compat="turnstile", the familiar cf-turnstile-response field is filled too.

server.js
const res = await fetch("https://shield.edge.network/siteverify", {
  method: "POST",
  body: new URLSearchParams({ secret, response: token }),
});
const { success, score } = await res.json();
if (!success || score < 40) return reject();

FAQ

Questions before switching

Is Shield's detection as strong as Turnstile's or reCAPTCHA's?
They draw on far larger networks and datasets than Shield does today. Shield's approach is different: proof-of-work makes automation expensive, difficulty escalates for repeat offenders, and a graduated score lets you decide rather than trusting a single verdict. The honest test is your own traffic: run Shield in shadow mode next to your current provider and compare.
Can I switch back if it doesn't work for us?
Yes. The siteverify format is Turnstile-compatible, and Shield never routes your traffic, so reversing the migration is the same two-line change.
Do I have to use other Edge products?
No. Shield is standalone and free, and works with any host, CDN or framework.
What about AI agents that should get through?
Agents that sign requests with Web Bot Auth are identified and passed to your server with their verified identity. Set the policy per widget: allow, challenge or block.

Try the free one with a score

Run Shield in shadow mode beside your current CAPTCHA and see the difference on your own traffic.

Get a sitekeyGet migration help

No card, no caps, no lock-in.