SilentShield is an invisible, GDPR-compliant CAPTCHA alternative to Google reCAPTCHA, Cloudflare Turnstile and hCaptcha. Instead of image puzzles, it verifies users through behavioural analysis and a proof-of-work nonce – with no cookies and no cross-site tracking. Every plan stores data on our servers in Germany, the widget is tested against WCAG 2.1 AA, and it installs with a single API key.
Comparison & Use Cases
See how SilentShield compares to reCAPTCHA, Turnstile, and hCaptcha
SilentShield compared
| Feature | SilentShield | reCAPTCHA | Turnstile | hCaptcha |
|---|---|---|---|---|
| Visibility to visitors | Invisible by default; a short arithmetic task when the result is unclear | Image challenges possible in all tiers | Mode of your choice: managed (checkbox on risk), non-interactive (visible widget), invisible | Passive mode only in Pro and Enterprise |
| Role under the GDPR | Processor, DPA available | Google as processor (since 2 April 2026) | not checked | not checked |
| Accessibility | Widget tested against WCAG 2.1 AA (automated and by keyboard) | not checked | WCAG 2.2 AA (according to Cloudflare) | Accessible solution (according to hCaptcha) |
| Cookies | None | _GRECAPTCHA (necessary cookie) | Pre-clearance cookie, if enabled | not checked |
| Free plan | 500 requests/month | Up to 10,000 assessments/month (payment method required) | Unlimited verifications, up to 20 widgets | Basic: free |
| Transferred size (gzip) | 48.9 KB | v2: 423 KB · v3: 459 KB | 27.5 KB | 742 KB |
Provider details from their official documentation and pricing pages (cloud.google.com/recaptcha, developers.cloudflare.com/turnstile, hcaptcha.com), checked on Oct 4, 2026. “not checked” means: no official source found. Transferred size: our own measurement of Sep 4, 2026 (SilentShield: Sep 23, 2026). Method and individual values
Use Cases
Contact Forms
Protect your contact forms from spam without losing real inquiries
Login & Registration
Prevent brute-force attacks and bot registrations
E-Commerce & Checkout
Stop cart bots and protect limited drops
APIs & Webhooks
Bot protection for your form and API endpoints
What changes when you switch
Verifiable differences instead of percentage promises
Detailed Comparison
Why SilentShield?
- Invisible by default: No interruption of the user flow
- GDPR compliant: Checks run on servers in Germany
- No cookies: The bot check sets not a single cookie
- Accessible: Widget tested against WCAG 2.1 AA
- Lightweight embedding: Script loaded with defer – it does not block page rendering
What to know about other solutions
- reCAPTCHA: Loads scripts from Google, sets the _GRECAPTCHA cookie, image challenges are possible in all tiers
- Turnstile: Needs a Cloudflare account; depending on the mode, a widget is visible
- hCaptcha: Passive mode only from Pro upwards ($139 per month)
- All three: Load a script from the provider’s server
Try the Live Demo
Interact with the form below — watch SilentShield analyze your behavior in real-time.
Behavior Analysis
Start interacting with the form to see the analysis.
Related pages
Frequently asked questions
How does SilentShield compare to other CAPTCHAs?
SilentShield is invisible by default, keeps data on our servers in Germany and is GDPR-compliant; it uses behavioural signals plus a proof-of-work nonce instead of image puzzles. Unlike reCAPTCHA it loads no scripts from Google. It sets no cookies and stores the IP address only as a hash.
SilentShield vs reCAPTCHA — which is better for privacy?
SilentShield is designed for privacy: servers in Germany, no cookies, no cross-site tracking, the IP address only as a hash. reCAPTCHA loads scripts from Google. SilentShield shows no image puzzle in the default mode, and the widget is tested against WCAG 2.1 AA.
SilentShield vs hCaptcha — what is the difference?
Both aim for privacy, but hCaptcha shows a visible widget and can present challenges. SilentShield is invisible by default, uses behavioural signals and a proof-of-work nonce, and keeps data on our servers in Germany with no cookies. Only when the result is unclear is there a short arithmetic task.
SilentShield vs Cloudflare Turnstile — how do they differ?
Both work in the background. Turnstile runs through Cloudflare and needs a Cloudflare account, but no Cloudflare CDN. SilentShield stores data on our servers in Germany on every plan, integrates via a single API key with a client script and backend nonce verification, sets no cookies and stores the IP address only as a hash.
Which CAPTCHA is best for GDPR compliance?
A CAPTCHA that stores data in the EU, sets no cookies and does not store the IP address in plain text is easier to use in line with the GDPR. SilentShield does this by default: servers in Germany, no cookies, the IP address only as a hash and no transfer to Google. For your specific use you remain the controller; we provide a data processing agreement.
Do invisible CAPTCHAs like SilentShield block real users?
No. SilentShield verifies genuine visitors invisibly through behavioral signals and a proof-of-work nonce, so real users pass without solving anything. Only your backend's verification of the nonce at the /api/v1/captcha/verify-nonce endpoint decides the outcome, and legitimate traffic is designed to pass without friction.