How to Find a Cloudflare Turnstile Sitekey

Before you can solve a Cloudflare Turnstile, you need its sitekey. It's a short public string, it starts with 0x4AAAAAAA, and it's sitting in the page's HTML in plain sight. Here's how to grab it in a few seconds, and what to do when the widget is loaded dynamically and doesn't show up in the raw source.

Quick answer: open the page, search the HTML for data-sitekey or 0x4AAAAAAA, and copy the value. That's the sitekey. The rest of this covers the cases where it isn't that simple.

The fast way: read it off the widget

Turnstile renders into an element that carries the key as a data-sitekey attribute:

<div class="cf-turnstile" data-sitekey="0x4AAAAAAAxxxxxxxxxxxx"></div>

In a browser, open DevTools, hit the elements panel, and search (Ctrl+F inside it) for cf-turnstile or data-sitekey. Copy the value. Done. If you'd rather stay in the terminal, curl the page and grep for the pattern:

curl -s https://target.com/ | grep -oE '0x4AAAAAAA[A-Za-z0-9_-]+' | head -1

When it's not in the raw HTML

Plenty of sites load Turnstile with JavaScript after the page renders, or configure it through the turnstile.render() call instead of a data attribute. Then a plain curl shows nothing, because the key only appears once scripts run. Two options.

Search the JavaScript. The key still has to reach the browser, so grep the page's scripts for sitekey or the 0x4AAAAAAA prefix. It's often passed as an argument to turnstile.render():

turnstile.render('#container', { sitekey: '0x4AAAAAAAxxxxxxxxxxxx' });

Or read it from a real browser. Load the page in a headless browser, wait for the widget, and pull the attribute:

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    page = p.chromium.launch().new_page()
    page.goto("https://target.com/")
    page.wait_for_selector("[data-sitekey]")
    sitekey = page.get_attribute("[data-sitekey]", "data-sitekey")
    print(sitekey)

The sitekey isn't a secret

Worth saying plainly: the sitekey is public by design. It's the client-side identifier the widget needs, so it's always exposed in the page. The private half (the secret key) lives on the site's server and never reaches you, and you don't need it. To solve the challenge you only need the public sitekey plus the page URL.

Once you have both, you're ready to solve. The full flow, with code and the token submission step, is in how to solve Cloudflare Turnstile, and the parameter reference is in the Peak docs.

FAQ

Where is the Turnstile sitekey?

In the page HTML, as the data-sitekey attribute on the widget element, or passed to turnstile.render() in the page's JavaScript. It always starts with 0x4AAAAAAA.

Is the sitekey secret?

No. The sitekey is public and always visible in the page. The secret key is separate, stays on the site's server, and you never need it to solve the challenge.

Have the sitekey and URL? Start solving free at peak.fo.