How to bypass any type of CAPTCHA

Every few months I hit the same wall: a site shows me a widget, I have no idea whether it's reCAPTCHA v3, hCaptcha, Turnstile, or some in-house slider, and the "solutions" I find online are a mix of dead repos, sketchy paid APIs, and blog posts from 2019.

So I started collecting everything in one place. That project is FuckCaptcha — an open reference for 39 CAPTCHA types, their context, and the approaches documented around them.

It's not a magic bypass library. It's a field guide: identify what you're looking at, understand how it works, and compare the documented options with their trade-offs.

Browse the interactive guide →

The problem it solves

CAPTCHA knowledge is scattered and goes stale fast. A single page might need:

• how the widget looks and how to identify it in the DOM or network tab,
• how the token flow works (site key → token → server-side verify),
• which free/open-source tools are actually maintained,
• which paid APIs exist when local solving isn't practical,
• and the practical gotchas (IP binding, token expiry, fingerprint checks).

FuckCaptcha puts all of that on one page per CAPTCHA, with a consistent structure so you can compare them side by side.

What's inside

The library covers the big families and a lot of regional/niche ones:

• Google — reCAPTCHA v2, v3, Enterprise
• Cloudflare — Turnstile and the full-page Challenge
• Bot management — DataDome, Kasada, HUMAN/PerimeterX, Akamai, Imperva, AWS WAF
• Puzzle/slider — GeeTest, Capy, Binance, TikTok, Temu, Yidun, Shumei, Aliyun, Tencent
• Privacy-friendly / PoW — Altcha, Friendly Captcha, Prosopo, Cap, CaptchaFox
• Classic — text-based, audio, slider, BotDetect, MTCaptcha, and more

Each page follows the same shape:

1. Complexity (1–5 stars, an editorial estimate — not a guarantee)
2. How it looks and how to identify it
3. How it works (the actual token/challenge flow)
4. Free bypass methods — a table of open-source tools with rough success rates
5. Practical tips — the stuff that actually decides pass/fail
6. Paid alternatives — when you need scale

There's also a cross-cutting solver index (browser automation, CAPTCHA-specific solvers, OCR/vision, audio) and a resources page.

A concrete example: Turnstile vs. Cloudflare Challenge

This is the confusion I see most often, so the guide splits them explicitly:

The practical takeaway from the page: Turnstile usually passes automatically in a clean, real browser — the hard part is fingerprint and IP reputation, not the click. And cf_clearance is bound to IP + User-Agent, so solving in a headless browser and reusing the cookie from requests with a different TLS stack usually fails. That's the kind of detail that saves hours.

How it's built

The whole thing is deliberately boring and static:

• Markdown is the source of truth. Every CAPTCHA lives in docs/captchas/*.md.
• The website never duplicates content. guide.html fetches the markdown and renders it in the browser (with a vendored marked build), so editing a .md file updates both GitHub and the site.
• index.html is the searchable/filterable library, with cards tagged by category (risk, puzzle, text, open) and difficulty.
• GitHub Pages serves it, and awesome-lint runs in CI to keep the list clean.

No framework, no build step, no database. Just HTML, CSS, a bit of JS, and a lot of markdown. If you want to add a CAPTCHA, it's: copy a page, add an SVG, add a card, add a README row, run npx awesome-lint.

Responsible use

This is the part I care about most. The project is explicitly for education and authorized research. It documents what's publicly known, keeps sourcing transparent, and asks you to respect the law, privacy, and the terms of the services you use. If you're testing, do it where you have permission.

Contributing

The guide is only useful if it stays current, and CAPTCHA vendors change things constantly. Contributions are very welcome:

• a new CAPTCHA page,
• a tool that's missing or a dead link,
• a correction to a token flow or a practical tip.

Start with CONTRIBUTING.md, and if the project is useful, a ⭐ helps other people find it.

Repo: https://github.com/vsmutok/FuckCaptcha
Live guide: https://vsmutok.github.io/FuckCaptcha/

What CAPTCHA type do you keep running into that isn't covered yet? Tell me in the comments and I'll add it.