This page shows how ephemeral IDs defeat attackers who rotate IPs and rotate credentials.
The attack pattern: A credential stuffing attacker has a list of stolen username/password pairs from a data breach. They try each one against your login form, rotating their source IP after each attempt (via a proxy pool or residential proxy service) so IP-based rate limiting doesn't fire. Traditional defences fail because every request looks like a different user.
Why Turnstile ephemeral IDs defeat this: The ephemeral ID is a device fingerprint hash issued by Turnstile, valid for a few days, scoped to your Cloudflare account. It stays the same even when the attacker rotates IPs. If you see 47 login attempts with 47 different usernames from 47 different IPs but only 1 ephemeral ID, that's not a real user population - that's one attacker.
Try a "login" attempt
The credentials don't have to be real - we're not actually logging you in, just recording the attempt. Try submitting several times with different usernames to see the ephemeral ID pattern.
Recent attempts (last 50, most recent first)
No attempts yet. Submit the form above to populate this table.
What to watch: If you submit the same form 5+ times from your browser (even with different usernames), all attempts will share the same ephemeral ID. The Worker flags any ephemeral ID that has appeared with 3+ distinct usernames as suspicious.