SilentShield is an invisible, GDPR-compliant CAPTCHA alternative to Google reCAPTCHA, Cloudflare Turnstile and hCaptcha. Instead of image puzzles, it verifies users through behavioural analysis and a proof-of-work nonce – with no cookies and no cross-site tracking. Every plan stores data on our servers in Germany, the widget is tested against WCAG 2.1 AA, and it installs with a single API key.
Comparison & Use Cases
See how SilentShield compares to reCAPTCHA, Turnstile, and hCaptcha
SilentShield compared
| Feature | SilentShield | reCAPTCHA | Turnstile | hCaptcha |
|---|---|---|---|---|
| Visibility to visitors | Invisible by default; a short arithmetic task when the result is unclear | Image challenges possible in all tiers | Mode of your choice: managed (checkbox on risk), non-interactive (visible widget), invisible | Passive mode only in Pro and Enterprise |
| Role under the GDPR | Processor, DPA available | Google as processor (since 2 April 2026) | not checked | not checked |
| Accessibility | Widget tested against WCAG 2.1 AA (automated and by keyboard) | not checked | WCAG 2.2 AA (according to Cloudflare) | Accessible solution (according to hCaptcha) |
| Cookies | None | _GRECAPTCHA (necessary cookie) | Pre-clearance cookie, if enabled | not checked |
| Free plan | 500 requests/month | Up to 10,000 assessments/month (payment method required) | Unlimited verifications, up to 20 widgets | Basic: free |
| Transferred size (gzip) | 48.9 KB | v2: 423 KB · v3: 459 KB | 27.5 KB | 742 KB |
Provider details from their official documentation and pricing pages (cloud.google.com/recaptcha, developers.cloudflare.com/turnstile, hcaptcha.com), checked on Oct 4, 2026. “not checked” means: no official source found. Transferred size: our own measurement of Sep 4, 2026 (SilentShield: Sep 23, 2026). Method and individual values
Use Cases
Contact Forms
Protect your contact forms from spam without losing real inquiries
Less spam in your inbox
No task for visitors by default
Verification on your server
Real enquiries get through without a hurdle
Login & Registration
Prevent brute-force attacks and bot registrations
Protection against automated login attempts
Fewer bot registrations
No image puzzle at login
Bot registrations are rejected before the account is created
E-Commerce & Checkout
Stop cart bots and protect limited drops
Detect cart bots
Scalping protection
No image puzzle at checkout
A check before every order
APIs & Webhooks
Bot protection for your form and API endpoints
Detect endpoint abuse
Fewer invalid requests to your backend
Reason codes per request in the dashboard
Invalid requests are rejected before processing
What changes when you switch
Verifiable differences instead of percentage promises
0
Image puzzles
None by default; only a short arithmetic task when the result is unclear
0
Cookies
The bot check sets not a single cookie
1
Checks per submission
Your server confirms every submission with one request
25
Languages
Widget and dashboard in 25 languages
Detailed Comparison
Why SilentShield?
- Invisible by default: No interruption of the user flow
- GDPR compliant: Checks run on servers in Germany
- No cookies: The bot check sets not a single cookie
- Accessible: Widget tested against WCAG 2.1 AA
- Lightweight embedding: Script loaded with defer – it does not block page rendering
What to know about other solutions
- reCAPTCHA: Loads scripts from Google, sets the _GRECAPTCHA cookie, image challenges are possible in all tiers
- Turnstile: Needs a Cloudflare account; depending on the mode, a widget is visible
- hCaptcha: Passive mode only from Pro upwards ($139 per month)
- All three: Load a script from the provider’s server
Try the Live Demo
Interact with the form below — watch SilentShield analyze your behavior in real-time.
your-website.com/contact
Behavior Analysis
Waiting
Mouse Movement0%
Keyboard Input0%
Scroll Behavior0%
Interaction Timing0%
Human Score0%
Start interacting with the form to see the analysis.
Related pages
GDPR-compliant CAPTCHAThe cookie-free CAPTCHA that is invisible by default — usable in a GDPR-compliant way.GDPR-compliant reCAPTCHA alternativeSee how SilentShield replaces Google reCAPTCHA — invisible by default and without cookies.hCaptcha alternativeSwitch from hCaptcha to bot protection that is invisible by default, from servers in Germany.Cloudflare Turnstile alternativeA Turnstile alternative that is invisible by default and sets no cookies.Friendly Captcha alternativeBot protection that is invisible by default, from servers in Germany.
Frequently asked questions
How does SilentShield compare to other CAPTCHAs?
SilentShield is invisible by default, keeps data on our servers in Germany and is GDPR-compliant; it uses behavioural signals plus a proof-of-work nonce instead of image puzzles. Unlike reCAPTCHA it loads no scripts from Google. It sets no cookies and stores the IP address only as a hash.
SilentShield vs reCAPTCHA — which is better for privacy?
SilentShield is designed for privacy: servers in Germany, no cookies, no cross-site tracking, the IP address only as a hash. reCAPTCHA loads scripts from Google. SilentShield shows no image puzzle in the default mode, and the widget is tested against WCAG 2.1 AA.
SilentShield vs hCaptcha — what is the difference?
Both aim for privacy, but hCaptcha shows a visible widget and can present challenges. SilentShield is invisible by default, uses behavioural signals and a proof-of-work nonce, and keeps data on our servers in Germany with no cookies. Only when the result is unclear is there a short arithmetic task.
SilentShield vs Cloudflare Turnstile — how do they differ?
Both work in the background. Turnstile runs through Cloudflare and needs a Cloudflare account, but no Cloudflare CDN. SilentShield stores data on our servers in Germany on every plan, integrates via a single API key with a client script and backend nonce verification, sets no cookies and stores the IP address only as a hash.
Which CAPTCHA is best for GDPR compliance?
A CAPTCHA that stores data in the EU, sets no cookies and does not store the IP address in plain text is easier to use in line with the GDPR. SilentShield does this by default: servers in Germany, no cookies, the IP address only as a hash and no transfer to Google. For your specific use you remain the controller; we provide a data processing agreement.
Do invisible CAPTCHAs like SilentShield block real users?
No. SilentShield verifies genuine visitors invisibly through behavioral signals and a proof-of-work nonce, so real users pass without solving anything. Only your backend's verification of the nonce at the /api/v1/captcha/verify-nonce endpoint decides the outcome, and legitimate traffic is designed to pass without friction.