We have been reviewing decaptcha tools on this site since a CAPTCHA meant six warped letters and a decent OCR engine could earn its keep. Distorted text still turns up on old forums and legacy login forms, but what stops production scrapers in 2026 is behavioral scoring, trajectory analysis, and puzzle engines that mutate faster than any narrow model can be retrained.
Two shifts matter more than any individual service on this list.
Frontier reasoning models have largely finished off visual recognition as a defense. A May 2025 benchmark had the best browser agent clearing 40% of a mixed CAPTCHA set against 93% for humans. By February 2026 the same class of puzzle was falling to reasoning-heavy models at rates near 90%.
Defenders responded by changing the question, from is this a human to which automated client is this, and what is it allowed to do. Cloudflare has not issued a visual puzzle since 2023. Forrester renamed its entire market category from Bot Management to Bot and Agent Trust Management in Q2 2026. There is now an IETF working group whose job is to let bots identify themselves cryptographically, and AWS WAF lets a properly signed agent through with no challenge at all.
One note before the details. Removing a CAPTCHA is a technical capability, not a legal permission. Solving challenges to collect public data is common practice and is bounded by each site's Terms of Service and by applicable law. Avoid content behind a login you are not entitled to use, respect robots.txt, and keep request rates reasonable. Two 2026 court decisions have made this line more interesting than it used to be, and we return to them at the end.
Our shortlist
The eight we would put into production today:
- 2Captcha for breadth. Nothing else covers as many challenge types.
- CapSolver for Cloudflare-heavy targets and low latency.
- CapMonster Cloud for volume economics and a flat $2.00 on FunCaptcha.
- Anti-Captcha for parallelism, stable documentation, and arbitrary human tasks.
- SolveCaptcha for the cheapest published token prices, if you can live with a vendor that publishes nothing about itself.
- DeathByCaptcha for drop-in migration, since it emulates three competitors' APIs.
- NopeCHA for browser-driven work and for hCaptcha, which most token APIs have quietly dropped.
- An unblocker API when you want pages rather than tokens. Scrapfly is cheapest, Bright Data is the best documented.
What a CAPTCHA tests
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. The name is from 2003 and describes a 2003 product.
Modern systems rarely rely on a single puzzle. They combine IP reputation, browser and TLS fingerprints, mouse and timing behavior, and account history into a risk score, then show a visible challenge only when that score crosses a threshold.
The 2024 COMPSAC paper Breaking reCAPTCHAv2 found reCAPTCHA v2 to be "heavily based on cookie and browser history data," with no significant difference in the number of challenges humans and bots have to work through. The puzzle is theater layered over a fingerprint check.
That has a practical consequence. If you are seeing CAPTCHAs constantly, the cheapest fix is usually not a better solver but a cleaner request profile, so the score never crosses the threshold. Solvers are for the residue.
The challenge types you will meet
Classic text and image-to-text
Distorted letters, numbers, arithmetic, or code words rendered as an image. The oldest format and the easiest for OCR and small neural nets, typically under a second. Still alive on legacy CMS installs, regional government portals, and old forum software.
Image-selection grids
The "select all squares with traffic lights" format. reCAPTCHA v2 and hCaptcha dominate, using similar grids trained on different datasets.
One correction to a claim that persists across most competing roundups: hCaptcha is not the Cloudflare default and has not been since 2023. Cloudflare moved from reCAPTCHA to hCaptcha in April 2020, launched Turnstile in beta in September 2022, and at Turnstile's GA in September 2023 stated that it had "finished replacing every CAPTCHA issued by Cloudflare with Turnstile" and would "never issue another visual puzzle to anyone, for any reason." If you are hitting hCaptcha, the site chose hCaptcha directly. It remains an independent product of Intuition Machines, priced at $139/month (or $99/month billed annually) for 100,000 evaluations with $0.99 per 1,000 overage.
Score-based and invisible
No puzzle at all. The system watches the interaction and returns a hidden risk score. reCAPTCHA v3 and Cloudflare Turnstile lead here, and Turnstile's managed mode is free for unlimited use, which is why it spread so fast.
Google's side of this changed substantially and quietly. Standalone "reCAPTCHA Classic," the version managed from the old admin console, is deprecated. No new Classic keys have been issued since Q3 2024, and automated migration to Google Cloud ran through Q1 2026, after which API access is locked for keys with no Google Cloud project attached. reCAPTCHA now sells as Essentials (free to 10,000 assessments per month), Premium ($8 flat for 10,001 to 100,000 assessments, then $1 per 1,000), and Enterprise (annual commitment at $1 per 1,000). One behavioral detail worth knowing if you are on the defending side: the legacy siteVerify endpoint fails open on overage, returning success with a 0.9 score, while CreateAssessment fails closed with a 429.
"Score-based means no challenge" is also no longer categorically true. Google's newer POLICY_BASED_CHALLENGE key type can trigger an interactive challenge off a score threshold.
Slider and puzzle-piece
You drag a piece into a gap, and the system analyzes the trajectory, velocity, and micro-hesitations of the movement. GeeTest is the best-known provider, strongest in China and wider APAC, currently on CAPTCHA v4 with a ninth adaptive verification type (Dynamic SVG Validation) added in February 2026.
GeeTest's own documentation puts trajectory analysis alongside environment probing for Selenium and Puppeteer signatures, emulator and device-farm fingerprints, and asynchronous JavaScript challenges. A perfect mouse curve from an obviously instrumented browser still fails.
Interactive and 3D puzzles
Arkose Labs FunCaptcha is the gamified family: rotate an object upright, match dice, pick out items in a rendered scene. This is the hardest commercial category for automatic solvers, and the price of a solve says so more clearly than any vendor claim.
Arkose has never published a puzzle-variant count, so figures like "over a thousand variants" come from third-party listicles rather than the vendor. The number Arkose does publish is 225+ risk signals, and its accessibility documentation enumerates three game families. Its named customers are Adobe, Dropbox, Expedia, Hotels.com, Meta, Microsoft, Roblox, Sony and ZIPAIR; the commonly cited X/Twitter and LinkedIn attributions appear in no Arkose primary source. Arkose's own MatchKey figure is that under 1% of bots solved the AI-resistant challenge against over 92% for the unaltered image, which is vendor-reported and has not been independently replicated.
Arkose itself has largely stopped describing itself as a CAPTCHA company. It launched Arkose Titan in January 2026 and an Agent Trust Manager in June 2026, both aimed at classifying agentic traffic rather than blocking it.
Audio
The accessibility fallback: a short recording of spoken digits or words. Speech-to-text handles it, and it remains the cheapest path on legacy login forms, often at half the price of the visual equivalent. 2Captcha and DeathByCaptcha both price audio well below their token rates.
Proof-of-work and privacy-first
Friendly Captcha and ALTCHA make the browser perform a small computational task instead of asking the user anything, so bulk automation gets expensive while ordinary visitors see nothing.
Neither is purely proof-of-work anymore. Friendly Captcha v2 combines PoW with dynamic risk-signal evaluation, and its real differentiator is compliance: WCAG 2.2 Level AA certified by TÜV, plus EAA, BITV 2.0, BFSG, RGAA and EN 301 549. One caveat for the EU-hosting claims that get repeated carelessly: Friendly Captcha's EU-only endpoint is restricted to higher-tier plans, and the default service runs on Cloudflare. ALTCHA is MIT-licensed and self-hosted, at v3.2.1 as of July 2026, and uses memory-hard Argon2/Scrypt specifically to blunt GPU acceleration.
Neither is unsolvable. 2Captcha lists ALTCHA at $2.99 per 1,000 and Friendly at $1.45.
Enterprise bot management
At the top sit the full platforms: DataDome, HUMAN Security, Kasada, reCAPTCHA Enterprise, hCaptcha Enterprise, AWS WAF, and Akamai. These layer JavaScript execution, fingerprinting, TLS analysis, and behavioral scoring, sometimes with a visible challenge as the last step.
Forrester's Q2 2026 Wave for this category, now called Bot and Agent Trust Management, placed DataDome, HUMAN and Kasada as Leaders; Arkose Labs, CHEQ and Netacea as Strong Performers; and hCaptcha and reCAPTCHA Enterprise as Contenders. Akamai, Imperva/Thales, Cloudflare and F5 were not evaluated in that Wave, so treat any listicle that ranks them on it as fabricated.
DataDome, Imperva/Incapsula, Kasada and Akamai all have commercial solver products aimed at them. They are expensive, not impossible.
How a solving service works
For token-based challenges the pattern is consistent:
- Your code detects the challenge and extracts its parameters, typically the site key and the page URL.
- You submit those to the service's API, creating a task and receiving a task ID.
- You poll until the service returns a response token, or for some challenges, click coordinates.
- You inject the token back into the page or send it with your request.
For classic image CAPTCHAs you upload the image and get text back.
The subtlety that breaks most first integrations is session consistency. A solved token is frequently bound to the browser session, user agent and IP that requested it. Solve from one IP and submit from another and the target rejects it. Several task types therefore require you to pass your own proxy to the solver, and some go further: CapSolver's DataDome integration requires your own proxies and a user agent matched to a specific Chrome version range on Windows.
A token that arrives 19 seconds after page load may already be stale. Retries and re-challenges are why your cost per record will not match the rate card.
Automatic versus human, and what the split looks like now
Two methods, and every serious service now blends them.
Automatic (OCR and AI). Models recognize the challenge with no human involved. Fast, cheap, excellent on high-volume repetitive work. Its weakness is novelty: when a provider ships an unusual variant, accuracy drops until retraining catches up.
Human-powered. Real workers solve in real time. Slower, often ten seconds or more, but capable of handling formats no model has ever seen.
Nobody publishes a credible split between the two. Every percentage in circulation traces back to solver marketing. What we do have is the price of human labor, published live by 2Captcha on its own worker-facing page: $0.14 to $0.60 per 1,000 for normal CAPTCHAs and $1.00 per 1,000 for reCAPTCHA v2.
Compare that to F5 Labs' 2021 first-hand investigation, in which a researcher worked as a solver and documented $0.30 per 1,000 for traditional CAPTCHAs and $1.01 for reCAPTCHA. The reCAPTCHA rate has not moved in five years. The floor for simple work has halved. Price the human tier accordingly: it is now a premium service for formats models cannot see, and a residual one for everything else.
No comparable first-hand investigation of CAPTCHA farms has been published since 2021, so anyone quoting current worker demographics or conditions is extrapolating.
What the research says about model performance
The academic picture inverted twice in three years, and the pricing follows it.
2023. Searles, Prapty and Tsudik ran a 13-month field study producing 9,141 valid records of reCAPTCHA v2 challenges from over 3,600 users. On the checkbox, bots were faster and perfect (1.4s, 100%) against humans at 1.85s and 80%. On image grids, bots were worse: 17.5s and 85% against humans at 10.4s and 93%. The popular summary "bots beat humans at CAPTCHAs" was only half right. Their estimate of the aggregate human cost was 819 million hours and roughly $6.1 billion of unpaid labor, and their recommendation was that reCAPTCHAv2 "should be deprecated."
2024, COMPSAC. Plesner, Vontobel and Wattenhofer's Breaking reCAPTCHAv2 reported solving 100% of challenges with YOLO-based segmentation, against 68–71% in prior work.
May 2025, Open CaptchaWorld. Across 20 CAPTCHA types and 225 puzzles, humans scored 93.3% and the best browser agent (Browser-Use with OpenAI o3) reached at most 40.0%. Interaction, not recognition, was the barrier.
February to June 2026, Next-Gen CAPTCHAs. That barrier collapsed. Reasoning-heavy models reached pass rates as high as 90% on complex logic puzzles that had been near the 40% ceiling nine months earlier. The same authors built a new cognitive-gap benchmark where humans score 98.8% Pass@1 and the strongest model manages 5.9%.
USENIX Security 2026, COGNITION. Testing seven multimodal LLMs across 18 real-world CAPTCHA task types, the authors found that hardening challenges with fine-grained localization and implicit counting drops state-of-the-art model success from over 95% to 0%.
Anything that is fundamentally an image-recognition task is now commodity-priced and will keep getting cheaper. Anything requiring multi-step interaction, cross-frame consistency, or precise spatial manipulation is where the remaining money and the remaining human labor sit. That is why FunCaptcha can cost 50 times a Turnstile token.
Do not solve what you can avoid
A solver removes the challenge in front of you. It does nothing about why the challenge appeared, and the single biggest trigger is a bad or overused IP.
A rotating proxy pool assigns a different IP per request or per interval, so traffic resembles many ordinary users rather than one machine. Residential and mobile pools work best because their addresses belong to real households and carriers and carry low risk scores. Pair that with a consistent, realistic browser fingerprint and human-like pacing and a large share of CAPTCHAs never fire, which is both cheaper and more stable than solving them afterwards.
Some token-based tasks require you to pass your own proxy to the solver so the token binds to the correct IP; check each service's task-type documentation. And rotation cuts both ways: rotate aggressively mid-session and you break the session consistency those same tokens depend on. Stable IP within a session, rotation between sessions, is usually the correct setting.
What a solve costs: verified prices
Prices below are USD per 1,000 solves, read from each provider's own pricing or API documentation on 10 August 2026. Ranges reflect volume tiers or, for reCAPTCHA v3 and FunCaptcha, difficulty tiers. A dash means the type is not offered; n/p means it appears in the API documentation with no published rate. Rate cards change often and without announcement, so confirm before committing.
| Service | Image / text | reCAPTCHA v2 | reCAPTCHA v3 | Turnstile | hCaptcha | GeeTest | FunCaptcha | DataDome |
|---|---|---|---|---|---|---|---|---|
| CapMonster Cloud | $0.30 | $0.60 | $0.90 | $1.30 | — | $1.20 | $2.00 | $2.20 |
| SolveCaptcha | $0.35 | $0.55 | $0.80 | $0.80 | — | $0.80 | $2.99–50 | $1.45 |
| CapSolver | $0.40 | $0.80 | $1.00 | $1.20 | — | $1.20 | — | $2.50 |
| AZcaptcha | $0.40 | $1.00 | $1.00 | $1.20 | n/p | n/p | n/p | — |
| Anti-Captcha | $0.50–0.70 | $0.95–2.00 | $1.00–2.00 | $2.00 | — | $1.80 | $3.00 | — |
| 2Captcha | $0.50–1.00 | $1.00–2.99 | $1.45–2.99 | $1.45 | $2.99 | $2.99 | $1.45–50 | $1.45 |
| ImageTyperz | $0.65 | $2.10 | $2.10 | $1.80 | n/p | $1.50–1.80 | $3.00 | — |
| DeathByCaptcha | $0.99–2.00 | $2.89 | $2.89 | $2.89 | — | $2.89 | — | $2.89 |
Three things stand out.
hCaptcha has quietly disappeared from most token price lists. CapSolver, CapMonster Cloud, DeathByCaptcha, Anti-Captcha and SolveCaptcha all omit it from current pricing and documented task types. Where it survives is 2Captcha (at $2.99 per 1,000, visible only in the API documentation rather than the pricing table), NopeCHA (which also handles hCaptcha video challenges), the unblocker products, and AZcaptcha and ImageTyperz where it is documented but unpriced. Several published comparisons still list hCaptcha for services that dropped it, so verify coverage before you sign up.
FunCaptcha remains the premium tier by a wide margin. 2Captcha and SolveCaptcha both top out at $50 per 1,000, roughly 35 to 60 times a Turnstile token. CapMonster's flat $2.00 (relaunched December 2025) and Anti-Captcha's $3.00 are the outliers worth testing against your specific target.
Nobody publishes a meaningful SLA. Advertised speeds are live counters that move between page loads, and success rates are self-reported. Anti-Captcha shows a uniform "5s" across every type. DeathByCaptcha quotes a range on its homepage ($0.99–$2) and a single different figure in its FAQ ($1.39).
Subscription and per-page models
Two shortlist services do not price per solve.
NopeCHA sells daily quotas: $4.99/month for 2,000 solves a day up to $99.99/month for 200,000, with a free tier of 100 recognitions per 24 hours. Its developer documentation prices token endpoints in credit multiples rather than flat solves, so the effective rate depends entirely on your challenge mix and on whether you actually consume the quota. At full utilization on the higher tiers it undercuts every per-solve price in the table above; at half utilization it does not.
9kw.eu runs on credits priced in euros: 40,000 credits for €5, with a standard CAPTCHA costing 10 credits, which is about €1.25 per 1,000. You can also earn credits by solving other people's challenges instead of paying.
Unblocker APIs: paying per page instead of per token
A different product category is often the better buy, and most CAPTCHA roundups omit it. Unblocker APIs take a URL and return rendered HTML, handling proxy rotation, JavaScript, fingerprinting and challenges internally. You never see a token.
Cost per 1,000 successful requests, derived from each vendor's published plan prices and credit weights:
| Product | Entry tier | Best published tier | Billing note |
|---|---|---|---|
| Scrapfly ASP, datacenter IPs | $0.75 | $0.45 | Failed requests are free |
| Oxylabs Web Unblocker | ~$0.94 | ~$0.75 | Priced per GB; assumes Oxylabs' own 10k results/GB |
| Bright Data Web Unlocker | $1.50 | $1.30 | Success-only billing, 98% claimed success |
| Scrapfly ASP + residential | $3.75 | $2.27 | 25 credits per request |
| ZenRows JS + premium proxy | $8.89 | $2.28 | 25 credits per request |
| ScrapingBee stealth proxy | $14.70 | $5.62 | 75 credits per request |
Oxylabs prices per gigabyte rather than per request, and the figures above use list prices; a 40% promotional code was live at the time of writing that brings them to roughly $0.56 and $0.45. ScrapingBee's stealth tier is four to ten times the cost of the alternatives for comparable targets.
Read these against the token table carefully, because they are not the same unit. A CapSolver reCAPTCHA v2 token at $0.80 per 1,000 still requires you to bring proxies, a browser, and the orchestration to bind them together. Scrapfly's $0.45 to $0.75 buys the whole outcome. The token API wins when you need the token itself: logins, form submissions, checkout flows, anything where the solved challenge has to travel inside a session you control.
The services in detail
Hybrid and human-backed
2Captcha has the broadest coverage on the market and is a reasonable default. It began human-powered and now runs AI first with human fallback. The supported list runs past 40 types: reCAPTCHA v2/v3/Enterprise and grid, hCaptcha, Turnstile, GeeTest v3 and v4, Arkose, DataDome, AWS WAF, Imperva, Tencent, Alibaba, Binance, Temu, VK, Yandex SmartCaptcha, plus the interaction primitives (rotate, coordinates, draw-around, drag-and-drop, bounding box). You pay only for solved CAPTCHAs. Official clients exist for Python, PHP, JavaScript, Go, Ruby, Java, C# and C++ on its GitHub organization, with PHP and Java updated as recently as 30 July 2026, and there is a live demo of most challenge types. The legacy in.php/res.php API still works, but new challenge types land in API v2 (createTask/getTaskResult) first.
Anti-Captcha has been running since 2007, which its own footer confirms, and is built around throughput: high parallelism, stable documentation, and browser extensions for Chrome, Firefox and Safari. Its distinctive feature is AntiGate custom tasks, where you describe an arbitrary job through the API and human workers carry it out, which is useful for one-off flows no solver supports. Two corrections against older roundups, this article's own previous version included: Anti-Captcha no longer offers hCaptcha or DataDome. Neither appears in its price list or its documented task types. reCAPTCHA Enterprise is also priced at $5 per 1,000, well above the market.
DeathByCaptcha has run a hybrid of OCR and human solvers for over 17 years by its own account. Its most underrated feature is migration: it exposes compatibility layers for the DeCaptcher, Antigate/Anti-Captcha and 2Captcha API schemes, so you can point an existing integration at it by changing a hostname. Current coverage includes reCAPTCHA v2/v3 and Invisible, GeeTest v3/v4, Turnstile, DataDome, KeyCaptcha, Capy, Lemin, AWS WAF and audio. It does not support hCaptcha or FunCaptcha, contrary to what several comparisons claim. Its blog was updated in July 2026; its nine client libraries were last touched in April 2026. We previously published a walkthrough of using DeathByCaptcha from C#.
SolveCaptcha publishes the cheapest token rates in the table, along with a per-type speed figure for each, which nobody else does. Its API is in.php/res.php with method names identical to 2Captcha's v1 scheme, so migration is close to trivial, though neither party advertises compatibility. It is fifth rather than first on our shortlist because the company publishes nothing about itself: no founding date, no legal entity, no ownership. Its GitHub clients and blog are active through 2026, so it is clearly a live operation, but you are buying from an unknown.
ImageTyperz remains competent on image work at $0.65 per 1,000. Its token pricing is uncompetitive at $2.10 for reCAPTCHA v2 and, more importantly, we found no dated evidence of development activity in 2025 or 2026: no blog, no changelog, no release notes, and its most recent published Python client shipped in early 2023. The site and API are live. Treat it as a maintenance-mode option.
9kw.eu is the community model, where you can pay in credits or earn them by solving. Its coverage is limited to classic formats plus mouse, puzzle and audio, with no hCaptcha, Turnstile, DataDome, GeeTest or Arkose support. Its news page has not been updated since April 2021. Live user counters suggest it still functions, but there is no product development behind it.
Automatic (AI and OCR)
CapSolver is AI-first and focused on the modern stack, with the lowest advertised latency figures on the list: under 1 second for image-to-text, under 3 seconds for reCAPTCHA v3, Enterprise, AWS WAF and Turnstile, under 5 for reCAPTCHA v2 and GeeTest, under 10 for a full Cloudflare Challenge. Its Cloudflare investment is real, covering both Turnstile and Challenge at $1.20. DataDome support covers slider and interstitial device checks and requires your own proxies with a matched Chrome user agent. It does not offer hCaptcha or FunCaptcha. Integration details live in its documentation; note that the pricing page moved to docs.capsolver.com/en/pricing/. Blog and repositories were updated in August 2026.
CapMonster Cloud is a pure-AI solver from ZennoLab, in the automation market since 2008, and it currently offers the best volume economics here. It publishes per-type success claims (99% on Turnstile and reCAPTCHA v2, 98% GeeTest, 97% DataDome and reCAPTCHA v2 Enterprise), a clean JSON API, and 26 documented challenge types including FunCaptcha, DataDome, Imperva, Yidun, Alibaba and Binance. It has no hCaptcha support. An n8n integration shipped in July 2026. The separate desktop product also called CapMonster ($37 to $97 per year) is a different thing from CapMonster Cloud.
AZcaptcha is the budget option, with reCAPTCHA v2 grid clicks at $0.10 per 1,000 and a stated 50% discount above 10 million solves a month. Its API documents hCaptcha and FunCaptcha but publishes no rate for either, GeeTest appears on the homepage but in neither the API docs nor the price list, and DataDome is absent everywhere. It is also the least transparent vendor here: no company name, no location, no founding year, no changelog, no blog. A live status endpoint is the only evidence of maintenance.
NopeCHA is best known for its browser extension, and it is the one to reach for when the extension model fits: browser-based and semi-manual workflows, or anything hCaptcha-heavy. Coverage includes hCaptcha (with video challenges), FunCaptcha, PerimeterX, GeeTest, Lemin, Yandex, AWS WAF and Turnstile. No other automatic solver here lists that combination. Release cadence is strong, with v0.6.1 shipping in June 2026, and its November 2025 release introduced online reinforcement learning for browser agents, collecting feedback from live CAPTCHA interactions.
GSA Captcha Breaker is a Windows OCR application from GSA GmbH in Rostock, sold as a lifetime license with no per-solve cost. Understand its architecture before buying: it is an OCR front end with a configurable fallback that forwards failures to a paid online service, and its own documentation still names services that are no longer operating. The last release, v4.88, is dated 6 November 2025, with no 2026 entries in the changelog as of August 2026. It earns its price on high volumes of classic image CAPTCHAs and nothing else. We covered it in an earlier GSA Captcha Breaker review.
Unblockers and browser infrastructure
Bright Data Web Unlocker handles CAPTCHAs as part of a pipeline rather than as an API call, wrapping IP rotation, JavaScript rendering and retries on top of a very large proxy network, billed only on success at $1.50 per 1,000 (dropping to $1.30 on the $499/month tier). It claims 98% success and covers Cloudflare, DataDome, PerimeterX, Akamai, Kasada, hCaptcha and reCAPTCHA. Bright Data publishes dated release notes through mid-2026, which no other vendor in this article does, and it shipped a Web MCP server with 60+ tools and one-click connection to Claude, Cursor and VS Code, plus an Agent Browser aimed at remote agentic sessions.
Scrapfly, ZenRows and Oxylabs Web Unblocker are the alternatives worth benchmarking against it. Scrapfly's anti-scraping-protection mode claims coverage across the major anti-bot vendors and is the cheapest verified path to a rendered page. All three shipped MCP servers or agent skills in 2025–2026.
Names from the earlier era
DeCaptcher (review), BypassCaptcha, Captcha Sniper and ExpertDecoders helped define the early decaptcha market, DeCaptcher with multi-language OCR APIs and Captcha Sniper by intercepting requests to other services to solve them locally. Their API schemes outlived them: DeathByCaptcha still ships a DeCaptcher compatibility layer. We keep the references for completeness, and would not start a new project on any of them.
Client libraries, SDKs, and the new agent integrations
You rarely need to write these API calls by hand.
- 2Captcha publishes official clients for Python, PHP, JavaScript, Go, Ruby, Java, C# and C++ on its GitHub organization.
- Anti-Captcha publishes official and community clients for Python, PHP, JavaScript, Java and C#. Note that
anti-captcha.com/clientsis the customer dashboard, not the library index, which is a link several guides get wrong. - CapSolver and CapMonster Cloud expose REST/JSON APIs with examples for the common browser-automation frameworks.
- SolveCaptcha and DeathByCaptcha both maintain clients across seven or more languages, DeathByCaptcha covering nine including C++, Go and Perl.
Most services share the create-task-then-poll flow, and several deliberately emulate the 2Captcha or Anti-Captcha schemes, so switching providers usually means changing an endpoint and a key rather than rewriting an integration. You can benchmark three vendors against your own targets in an afternoon.
The 2026 addition is MCP. 2Captcha (mcp-captcha-solver), CapSolver and several unblockers now ship Model Context Protocol servers so that coding agents can call a solver directly. Set expectations accordingly: 2Captcha's server currently supports reCAPTCHA v2 only, and both it and CapSolver's have single-digit star counts and a handful of commits. These are announcements more than products. Bright Data's and Scrapfly's hosted MCP servers are the mature end of the category.
Can general-purpose AI solve CAPTCHAs now?
For recognition, mostly yes.
Multimodal models from OpenAI, Anthropic, Google, DeepSeek and others read images and reason about them well enough that distorted text, arithmetic puzzles and object-recognition grids are within reach, and the dedicated services lean on exactly this class of model for their automatic tiers. The February 2026 results cited earlier, with reasoning models reaching 90% on puzzles that had been at a 40% ceiling nine months before, mark the point where this stopped being arguable.
A general chatbot still is not a drop-in replacement for a solving service, for four reasons.
The token round-trip. reCAPTCHA, hCaptcha and Turnstile return a response token bound to a site key, session and IP. A model that reads the picture correctly still does not produce a valid session-matched token. That orchestration is the product you are buying.
Interaction. Trajectory analysis, multi-step 3D manipulation and invisible scoring depend on how you move, not what you see, and the COGNITION results show these can be deliberately engineered to hold: hardened challenges dropped state-of-the-art model success from over 95% to zero.
Throughput and consistency. For live high-volume scraping, a general chatbot is slower, less predictable and not designed for the concurrency that purpose-built solvers and worker pools deliver.
Policy. Several providers explicitly refuse. Anthropic's documentation for Claude in Chrome lists "bypassing captchas" among actions Claude cannot perform. OpenAI's Operator is trained to hand control back to the user for CAPTCHAs rather than solve them.
The bigger shift: from blocking bots to authenticating agents
Everything above assumes the adversarial model that has held for twenty years, where the site tries to exclude automation and you try to look human. That model is being replaced.
The trigger is volume. Cloudflare Radar recorded automated traffic passing human traffic in June 2026, at 57.5% bots against 42.5% humans for requests to HTML content, more than a year earlier than Cloudflare's own CEO had predicted at SXSW that March. Thales/Imperva's 2026 Bad Bot Report, covering 2025, put automated traffic at 53% and noted daily blocked AI-related incidents rising from 2 million to 25 million. AI training crawlers went from 22% of crawler requests in spring 2025 to 52% by June 2026.
At that scale, "block the bots" stops being a coherent policy. The responses are converging on identity.
Web Bot Auth is the standards effort. The IETF chartered a working group in October 2025 with an explicit scope note that it is not building a bot-detection standard; it is building a way for bots to identify themselves. The mechanism is HTTP Message Signatures (RFC 9421): the client signs requests with an Ed25519 key, adds Signature, Signature-Input and Signature-Agent headers, and publishes its public keys as a JWKS document at /.well-known/http-message-signatures-directory. The current core draft is draft-meunier-webbotauth-httpsig-protocol-01, dated August 2026, co-authored by Cloudflare and Google. As of August 2026 there is still no adopted working-group document; the April 2026 milestones have slipped.
Adoption is running ahead of the standard anyway. OpenAI publishes signing keys at chatgpt.com/.well-known/http-message-signatures-directory and signs Operator requests. Google runs an experimental Google-Agent identity at agent.bot.goog and explicitly warns that only a subset of its requests are signed. Akamai added verification to App & API Protector in November 2025. AWS WAF began auto-allowing Web Bot Auth-verified bots by default in November 2025, at no extra charge for CloudFront-fronted distributions. Amazon's Bedrock AgentCore Browser ships a feature whose stated purpose is to reduce CAPTCHA interruptions by signing requests instead of solving challenges. Kasada launched AI Agent Trust in January 2026. HUMAN Security open-sourced a reference implementation.
Akamai, AWS, Kasada and HUMAN sell bot management. All four now ship the bypass, because a signed, well-behaved agent is a customer relationship.
Cloudflare's commercial layer is the most aggressive. It changed defaults to block AI crawlers on new domains in July 2025, launched Pay Per Crawl as a private beta using HTTP 402 and a crawler-price header, and extended it in July 2026 with Pay Per Use, which pays publishers when their content appears in an AI answer rather than when it is fetched. The reasoning it gave is worth quoting for anyone running a crawler: more than 50% of crawl traffic from good bots re-fetches pages that have not changed. More consequential for planning, from 15 September 2026 Cloudflare splits bot classification into Search, Agent and Training, and for new customers, new sites and all free-tier users, Training and Agent traffic is blocked by default on ad-monetized pages. Mixed-use crawlers that cannot separate their purposes get blocked outright there.
The human side is moving too. In June 2026 Cloudflare announced PACT (Private Access Control Tokens) with Mozilla, Chrome, Edge and Shopify: blinded anonymous tokens that let a site with strong knowledge of personhood vouch for a user, explicitly aimed at reducing "paywalls, identity checks, CAPTCHAs, and invasive tracking." Apple's Automatic Verification already does a narrower version of this, privately authenticating a device so the user does not have to complete a CAPTCHA at all. Safari was conspicuously absent from the PACT launch coalition despite Apple co-authoring the predecessor.
Agentic browsers are splitting into camps on the CAPTCHA question:
- Hand off. OpenAI's Operator is trained to ask the user to take over for CAPTCHAs, logins and payments.
- Refuse. Claude in Chrome lists CAPTCHA bypass as a prohibited action.
- Solve. Browserbase exposes a
solveCaptchas: truesession flag, while simultaneously participating in Cloudflare's Signed Agents program. The same product ships both the evasion and the identity path. - Invert. Browser Use built what it calls a reverse CAPTCHA for its own signup, designed to keep humans out and let agents in.
And the courts got involved. Amazon sued Perplexity in November 2025 over Comet presenting itself as ordinary Chrome. A preliminary injunction issued in March 2026 was vacated by the Ninth Circuit on 4 August 2026, which held that it is the user who accesses Amazon's computers, with the help of the assistant, to carry out specific acts on Amazon.com. Separately, in Reddit's case against Perplexity and SerpApi, a judge allowed the DMCA §1201(a) anti-circumvention claims to proceed on 31 July 2026, on the theory that Google's protections function as an access-control measure. Both rulings are narrow and neither is final. The distinction they are groping toward is the one engineers are already making: acting on a user's instruction is not the same as circumventing a technical measure at scale.
What this means for your project
Work out which lane you are in before you buy anything.
If you are building a user-directed agent, the signed path is open. Publish a key directory, sign your requests, register with Cloudflare's verified-bot program, and a growing share of the web will let you through without a challenge. AWS WAF already does.
If you are running a crawler at scale against ad-supported publishers, note the 15 September 2026 Cloudflare default and plan for it. A solver does not help when the policy is a category-level block.
If you are collecting public data from sites with no agent policy, which is still most of the web, the advice above stands.
How to choose
Three inputs decide most of this: the challenge type, whether you need a token or a page, and your monthly volume.
By challenge type. For everyday reCAPTCHA and Turnstile, CapMonster Cloud and SolveCaptcha have the cheapest verified rates and CapSolver the fastest advertised. For FunCaptcha, test CapMonster's flat $2.00 and Anti-Captcha's $3.00 before accepting a per-solve price that runs to $50. For hCaptcha, your realistic options are 2Captcha, NopeCHA, or an unblocker. For DataDome, 2Captcha and SolveCaptcha are cheapest at $1.45, while CapMonster costs $2.20 and is the only one publishing a success figure (97%). For anything obscure or region-specific, 2Captcha's coverage is unmatched, and Anti-Captcha's custom tasks handle what no API supports.
By output. Need a token inside a session you control, as with logins and checkouts? Buy a token API. Need a rendered page? Price the unblockers first; they are frequently cheaper once you account for the proxies, browsers and retry logic you would otherwise build.
By volume. Below roughly 50,000 solves a month the price differences here are rounding errors, so optimize for coverage and documentation. Above a few million, the gap between $0.60 and $2.89 for a reCAPTCHA v2 token is the entire budget, and it is worth running a real benchmark against your targets rather than trusting any rate card, including this one.
Run the counterfactual first. Better proxies and a more convincing browser profile often cost less than the CAPTCHAs they prevent.
Prices and capabilities verified against provider documentation on 10 August 2026.