How to Bypass CAPTCHAs (2026 Methods)

Quick verdict: CAPTCHA bypass in 2026 splits four ways. Avoidance — clean residential IPs + realistic browser fingerprints means most sites never show you a CAPTCHA. Solver APIs — Capsolver, 2Captcha, NopeCHA, CapMonster, $0.50–$3 per 1k solves, work on reCAPTCHA v2/v3, hCaptcha, Turnstile, image-grids. Vision LLMs — GPT-4V and Claude can solve image CAPTCHAs but cost 100x more than dedicated solvers. Browser automation tricks — specific bypasses for Turnstile (CF Clearance), reCAPTCHA v3 (score-faking). Prefer avoidance; reach for solvers only when the target captchas you anyway.

Know What You're Bypassing

Method 1: Avoidance (Best, Always Try First)

Modern CAPTCHAs fire based on a risk score, not at random. Reduce the score, and most sites never show you one. The big levers:

• Use residential IPs. Datacenter IPs alone trigger CAPTCHAs on most protected sites. A residential or mobile IP starts you at low risk.
• Realistic browser fingerprint. Don't scrape with bare curl; use a real browser (Playwright with stealth, Patchright, undetected-chromedriver). Match TLS fingerprint to a real Chrome via curl_cffi or impersonation.
• Human-like pacing. 500ms–3s between requests; small random jitter. Bots that hit a site at 100ms intervals trip behavior detection in seconds.
• Real referer + cookies. Don't scrape product pages without first hitting the homepage and accepting cookies.
• Warm the session. One scrape per session is suspicious; 3–5 page views in a natural order is normal.

Done right, avoidance handles 90% of CAPTCHA scenarios. Reach for solvers only when the target captchas you despite all of this.

Method 2: CAPTCHA Solver APIs

Solver services accept a CAPTCHA payload (image, sitekey, page URL) and return the solution within seconds. Workflow:

1. Detect the CAPTCHA on the page.
2. Extract the sitekey (visible in the page HTML) and the page URL.
3. POST to the solver API.
4. Poll until the solver returns a token.
5. Inject the token into the page's form / hidden input.
6. Submit.

# 2Captcha example with reCAPTCHA v2
import requests
import time

api_key = "YOUR_2CAPTCHA_KEY"
sitekey = "6Lc..."          # from the page
pageurl = "https://target.com/login"

# 1. Submit the captcha
r = requests.post("https://2captcha.com/in.php", data={
    "key": api_key, "method": "userrecaptcha",
    "googlekey": sitekey, "pageurl": pageurl, "json": 1
})
cid = r.json()["request"]

# 2. Poll for the solution (typically 15-45 seconds)
for _ in range(40):
    time.sleep(5)
    res = requests.get(f"https://2captcha.com/res.php"
                       f"?key={api_key}&action=get&id={cid}&json=1").json()
    if res["status"] == 1:
        token = res["request"]
        break

# 3. Use token: page.evaluate(f"document.getElementById('g-recaptcha-response').innerHTML='{token}'")

See our 6 best CAPTCHA solving tools for a full price + accuracy comparison. Headline numbers (2026): reCAPTCHA v2 ~$1/1k, hCaptcha ~$1.50/1k, FunCaptcha ~$3/1k, Turnstile ~$3/1k.

Method 3: Vision LLMs (GPT-4V, Claude Vision, Gemini)

For custom image CAPTCHAs that no solver service supports, modern vision LLMs can solve them directly. Send a screenshot, ask for the answer.

from openai import OpenAI
import base64

with open("captcha.png", "rb") as f:
    img = base64.b64encode(f.read()).decode()

client = OpenAI()
resp = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": [
        {"type": "text", "text": "What letters and numbers are in this captcha?"},
        {"type": "image_url", "image_url": {"url": f"data:image/png;base64,{img}"}}
    ]}]
)
print(resp.choices[0].message.content)

Cost: ~$0.01–$0.03 per solve. Far more expensive than dedicated solvers ($0.001–$0.003) but works on never-seen-before captchas where 2Captcha would fail.

Cloudflare Turnstile

Turnstile is Cloudflare's 2023+ CAPTCHA replacement. By default it shows no challenge — just runs JS in the background and decides. Bypass approaches:

• FlareSolverr (the standard tool). Docker container + Python client. Solves transparently, returns cf_clearance cookie. See our FlareSolverr guide.
• Solver APIs that support Turnstile. Capsolver, NopeCHA, 2Captcha all added Turnstile support in 2024–25.
• Real Playwright with stealth. Patchright, undetected-playwright; sometimes enough to pass without a solver.
• Mobile / Residential IPs. Turnstile's score includes IP reputation; clean IPs reduce the chance of escalation to an interactive challenge.

reCAPTCHA v3 (Score-Faking)

reCAPTCHA v3 returns a score 0.0–1.0 to the backend; the backend decides what to do. Bypass strategies:

1. Solver API. Returns a high-score token, typically 0.7+. Costs $1-$2/1k.
2. Real browser + clean IP. A genuine Playwright session through a residential proxy scores 0.7-0.9 routinely without any solver.
3. Cookie persistence. Google's score is partly based on prior Google account / cookie history. Run with a warmed browser profile that has visited Google before.

hCaptcha

hCaptcha is Cloudflare's previous default (pre-Turnstile) and still common on many sites. Image-grid based. Solver workflow is identical to reCAPTCHA v2 with a different method name. Cost: ~$1.50/1k. Capsolver and CapMonster handle hCaptcha well; some older solvers (2Captcha) work but with slightly lower success rates.

Real Cost Comparison (10k Solves)

Legal & Ethical

CAPTCHA bypass is legal in most jurisdictions when used on sites where you have legitimate access (your own accounts, public data scraping, research). It violates many sites' Terms of Service, which means civil consequences (account suspension) but rarely criminal liability. Don't use bypass for account fraud, credential stuffing, ticket scalping at restricted volumes, or anything that breaks computer-fraud laws in your jurisdiction. Solver services typically prohibit financial fraud and CSAM-adjacent abuse in their ToS.

Best-Practices Checklist

• Try avoidance first — clean residential IP + realistic browser fingerprint.
• Don't solve captchas you didn't expect — investigate why one fired.
• Pair solvers with proxies. A solved CAPTCHA on a banned IP gets banned again on the next request.
• Cache solver tokens when reusable (Turnstile cf_clearance lasts ~30 minutes).
• Monitor solver success rates. A drop below 80% usually means the CAPTCHA vendor updated; switch solvers or wait for updates.
• Budget for retries. 95% success rate + 5 retries = 99.99% effective.

Related: 6 best CAPTCHA solving tools · FlareSolverr guide · Cloudscraper tutorial · How to avoid scraper detection.