Both Cloudflare Turnstile and a self-hosted proof-of-work challenge aim to do the same thing: let humans through and make automation expensive, without the misery of image puzzles. They arrive at it from opposite directions. Turnstile is a managed service that outsources the decision to Cloudflare. Proof-of-work is a mechanism you run yourself that imposes a measurable compute cost on every request.
The choice is less about raw bot-blocking and more about where your data goes, what you depend on, and how much control you keep. This comparison walks through how each works and when each fits.
How Turnstile works
Turnstile drops a widget on your page that runs a set of non-interactive browser challenges and behavioral checks. Cloudflare evaluates the signals, largely informed by the traffic it sees across its network, and returns a token your backend verifies against their API. For most visitors it is invisible; there is no puzzle to solve.
The strengths are real:
- Zero UI friction for the majority of users.
- Backed by network-scale traffic intelligence.
- Trivial to deploy: a script tag and a server-side verify call.
The costs are structural rather than monetary:
- The verdict is made by Cloudflare, not you. You cannot fully inspect or tune the model.
- Visitor data traverses a third party, which raises data-residency and GDPR questions.
- You inherit a hard dependency on their availability and policy decisions.
How self-hosted proof-of-work works
A proof-of-work challenge asks the client to find an input that produces a hash with a required property, for example a certain number of leading zeros. Finding it takes work; verifying it is instant. Prynt Challenge issues the puzzle, the browser solves it in a web worker, and your server checks the solution before issuing a token.
server -> challenge{ seed, difficulty }
client -> loop: hash(seed + nonce) until hash < target
client -> solution{ nonce }
server -> verify hash(seed + nonce) < target -> issue token
The defense is economic. A legitimate user solves one puzzle in a few hundred milliseconds and never notices. An attacker running a million requests must solve a million puzzles, which is real CPU time and real money across their fleet. Raise the difficulty for suspicious traffic and lower it for clean traffic to keep honest users fast.
Its strengths are the mirror image of Turnstile’s:
- Runs entirely on your infrastructure; no visitor data leaves your control.
- No third-party dependency in the request path.
- Fully inspectable and tunable, including adaptive difficulty driven by your own suspect score.
Its limits: proof-of-work alone does not identify the client or catch a patient, low-volume attacker who is willing to pay the compute. It is a cost multiplier, not an identity signal.
Side by side
| Dimension | Cloudflare Turnstile | Self-hosted proof-of-work |
|---|---|---|
| Where the decision is made | Cloudflare | Your infrastructure |
| Visitor data exposure | Flows through third party | Stays local |
| Dependency | External service | None |
| Tunability | Limited | Full, including adaptive difficulty |
| Primary defense | Network intelligence + behavior | Compute cost |
| Best against | Broad automated abuse | High-volume flooding |
The stronger answer is layered
Framing this as either/or misses the better architecture. Proof-of-work is a rate mechanism, not an identity system. Its natural partner is device intelligence: identify the client first, then challenge only the ambiguous slice.
A layered flow:
- Fingerprint every visitor silently and compute a confidence score.
- Clear the obvious humans with no challenge at all.
- Issue an adaptive proof-of-work challenge to medium-risk requests, difficulty scaled by risk.
- Block or step up the high-risk requests flagged as bots or coming through datacenter IPs.
This gives you Turnstile’s invisibility for good users and proof-of-work’s economic wall for attackers, without handing your traffic to anyone. It also composes with captcha alternatives and slots into an edge deployment or an nginx auth-request gate if you want the check at the perimeter.
Choosing for your stack
Pick Turnstile if you want the fastest possible deployment, have no data-residency constraints, and are comfortable outsourcing the verdict. Pick self-hosted proof-of-work if you are already running a self-hosted or privacy-first stack, need every signal to stay in your infrastructure, or want to tune difficulty against your own risk model. For most teams building deliberately, the proof-of-work path plus device intelligence is the durable choice because it keeps control and data where they belong.
Frequently asked questions
Is Cloudflare Turnstile free?
Turnstile is offered at no direct cost, but the trade is data and dependency: challenge decisions are made by Cloudflare, visitor data flows through their network, and you rely on their availability and policies.
How does proof-of-work stop bots without a puzzle?
It forces the client to spend CPU solving a cryptographic problem before proceeding. One solve is trivial, but an attacker sending millions of requests pays millions of times the compute cost, which prices out large-scale abuse.
Can I run proof-of-work fully self-hosted?
Yes. A self-hosted proof-of-work challenge issues and verifies tokens on your own infrastructure, so no visitor data leaves your control and there is no third-party dependency in the request path.
Turnstile trades control for convenience; self-hosted proof-of-work trades a little setup for full ownership of your data and your decisions. Neither is a complete bot defense alone, which is why the strongest deployments pair proof-of-work with device intelligence. See the bot detection pillar and try the challenge flow in the playground.
Run it yourself
Prynt is open-source, self-hostable device intelligence — visitor IDs, bot & fraud Smart Signals, and behavioral biometrics you own end to end.