Quick verdict: CAPTCHA bypass in 2026 splits four ways. Avoidance — clean residential IPs + realistic browser fingerprints means most sites never show you a CAPTCHA. Solver APIs — Capsolver, 2Captcha, NopeCHA, CapMonster, $0.50–$3 per 1k solves, work on reCAPTCHA v2/v3, hCaptcha, Turnstile, image-grids. Vision LLMs — GPT-4V and Claude can solve image CAPTCHAs but cost 100x more than dedicated solvers. Browser automation tricks — specific bypasses for Turnstile (CF Clearance), reCAPTCHA v3 (score-faking). Prefer avoidance; reach for solvers only when the target captchas you anyway.
| CAPTCHA | How it fires | Best bypass |
|---|---|---|
| reCAPTCHA v2 ("I'm not a robot") | Click + image grid if suspicious | Solver API ($1-$2 / 1k) |
| reCAPTCHA v3 (invisible score) | Backend gets a 0.0-1.0 risk score | Solver API ($1-$2 / 1k) or score-fake |
| reCAPTCHA Enterprise | Backend score, harder to fake | Solver API + good IP + good fingerprint |
| hCaptcha | Image grid (privacy-focused) | Solver API ($1-$3 / 1k), CapSolver |
| Cloudflare Turnstile | JS challenge, no images by default | FlareSolverr, Capsolver Turnstile |
| FunCaptcha (Arkose) | Rotation puzzles | Solver API ($2-$4 / 1k), specialized |
| Geetest v4 | Slider + behavioral | Solver API with behavior model |
| Image-grid (custom) | Site-specific image challenges | Vision LLM (GPT-4V, Claude) |
| Math / text CAPTCHA (legacy) | "What is 3+5?" | OCR + simple solver |
Modern CAPTCHAs fire based on a risk score, not at random. Reduce the score, and most sites never show you one. The big levers:
curl; use a real browser (Playwright with stealth, Patchright, undetected-chromedriver). Match TLS fingerprint to a real Chrome via curl_cffi or impersonation.Done right, avoidance handles 90% of CAPTCHA scenarios. Reach for solvers only when the target captchas you despite all of this.
Solver services accept a CAPTCHA payload (image, sitekey, page URL) and return the solution within seconds. Workflow:
sitekey (visible in the page HTML) and the page URL.# 2Captcha example with reCAPTCHA v2
import requests
import time
api_key = "YOUR_2CAPTCHA_KEY"
sitekey = "6Lc..." # from the page
pageurl = "https://target.com/login"
# 1. Submit the captcha
r = requests.post("https://2captcha.com/in.php", data={
"key": api_key, "method": "userrecaptcha",
"googlekey": sitekey, "pageurl": pageurl, "json": 1
})
cid = r.json()["request"]
# 2. Poll for the solution (typically 15-45 seconds)
for _ in range(40):
time.sleep(5)
res = requests.get(f"https://2captcha.com/res.php"
f"?key={api_key}&action=get&id={cid}&json=1").json()
if res["status"] == 1:
token = res["request"]
break
# 3. Use token: page.evaluate(f"document.getElementById('g-recaptcha-response').innerHTML='{token}'")
See our 6 best CAPTCHA solving tools for a full price + accuracy comparison. Headline numbers (2026): reCAPTCHA v2 ~$1/1k, hCaptcha ~$1.50/1k, FunCaptcha ~$3/1k, Turnstile ~$3/1k.
For custom image CAPTCHAs that no solver service supports, modern vision LLMs can solve them directly. Send a screenshot, ask for the answer.
from openai import OpenAI
import base64
with open("captcha.png", "rb") as f:
img = base64.b64encode(f.read()).decode()
client = OpenAI()
resp = client.chat.completions.create(
model="gpt-4o",
messages=[{"role": "user", "content": [
{"type": "text", "text": "What letters and numbers are in this captcha?"},
{"type": "image_url", "image_url": {"url": f"data:image/png;base64,{img}"}}
]}]
)
print(resp.choices[0].message.content)Cost: ~$0.01–$0.03 per solve. Far more expensive than dedicated solvers ($0.001–$0.003) but works on never-seen-before captchas where 2Captcha would fail.
Turnstile is Cloudflare's 2023+ CAPTCHA replacement. By default it shows no challenge — just runs JS in the background and decides. Bypass approaches:
reCAPTCHA v3 returns a score 0.0–1.0 to the backend; the backend decides what to do. Bypass strategies:
hCaptcha is Cloudflare's previous default (pre-Turnstile) and still common on many sites. Image-grid based. Solver workflow is identical to reCAPTCHA v2 with a different method name. Cost: ~$1.50/1k. Capsolver and CapMonster handle hCaptcha well; some older solvers (2Captcha) work but with slightly lower success rates.
| Method | Cost | Latency | Success rate |
|---|---|---|---|
| Avoidance (residential + stealth) | $0 | 0s | ~70-90% never see a captcha |
| 2Captcha reCAPTCHA v2 | ~$10 | 15-45s per solve | ~95% |
| Capsolver Turnstile | ~$30 | 5-15s per solve | ~92% |
| FlareSolverr (self-hosted) | Compute only | 5-15s per solve | ~85% |
| GPT-4V image CAPTCHA | ~$200-$300 | 2-5s per solve | ~85% on common types |
| NopeCHA hCaptcha | ~$15 | 10-20s per solve | ~93% |
CAPTCHA bypass is legal in most jurisdictions when used on sites where you have legitimate access (your own accounts, public data scraping, research). It violates many sites' Terms of Service, which means civil consequences (account suspension) but rarely criminal liability. Don't use bypass for account fraud, credential stuffing, ticket scalping at restricted volumes, or anything that breaks computer-fraud laws in your jurisdiction. Solver services typically prohibit financial fraud and CSAM-adjacent abuse in their ToS.
Related: 6 best CAPTCHA solving tools · FlareSolverr guide · Cloudscraper tutorial · How to avoid scraper detection.