Cloudflare Turnstile vs hCaptcha
Both pitched as the reCAPTCHA replacement. Privacy, accuracy, and the publisher-revenue catch.
Both are pitched as drop-in replacements for reCAPTCHA, and both succeed at that part. The differences show up in the privacy model and the business model.
Privacy
Turnstile does not require cookies, does not fingerprint, and uses Cloudflare's existing network telemetry to score the request. No user data is sold, none of it is shared with third parties. The data Turnstile collects (request headers, TLS fingerprint, IP) is used to score that request and nothing else.
hCaptcha on the free Publisher tier monetizes by sending visitor challenges to enterprise labeling customers (training data for image recognition). The labeling work is what makes Publisher tier profitable for hCaptcha. On the Pro tier ($99/mo+), no labeling work is sent and the privacy story is cleaner. Most sites using hCaptcha are on the free tier, which means most hCaptcha instances are routing label work through their visitors.
Accuracy
For commodity bot traffic, both block 95%+ of automation with low false positives. Turnstile has slight edge thanks to Cloudflare's huge IP reputation dataset (Cloudflare sees roughly 20% of all web traffic and has live data on which IPs misbehave). hCaptcha has slightly higher false positives on mobile due to image puzzle difficulty, but that's only relevant on the Pro tier where labeling tasks aren't included.
Cost
Turnstile is free with no usage cap. hCaptcha is free up to 1M requests/month on the Publisher tier (with label work) or $99/mo flat for Pro (no labeling, 1M requests included, $1 per 1k above). For most sites, Turnstile costs nothing forever; hCaptcha Pro is a real $1,200+/year ongoing.
Verdict
Use Turnstile by default in 2026. Use hCaptcha Pro if you specifically need an alternative provider for compliance or vendor diversity reasons, and you can afford the $99/mo. Avoid hCaptcha Publisher tier on any site where your users would mind being shown labeling tasks.