Anyone who has spent time building scrapers, bots, or automated test suites eventually runs into the same wall: a CAPTCHA. Over the years we have tested a large number of "decaptcha" tools and services, and the landscape has changed dramatically. The old world of twisted-letter images is mostly gone, replaced by behavioral scoring, interactive puzzles, and full bot-detection systems. This guide explains the different CAPTCHA types you will encounter today, the two broad families of solving technology, the role of rotating proxies, the services and libraries worth knowing, and the growing ability of general-purpose AI models to handle some of these challenges on their own.
A quick note before we start: removing a CAPTCHA is a technical capability, not a legal permission. Solving challenges to collect public data is common, but it is bounded by each site's Terms of Service and by applicable law. Avoid scraping content behind a login you are not entitled to access, respect robots.txt, and keep your request rates reasonable.
What a CAPTCHA Is
CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart." Its job is to decide, at a particular moment, whether the visitor is a person or a script. Modern systems rarely rely on a single puzzle; instead they combine signals — IP reputation, browser fingerprint, mouse and timing behavior, and TLS characteristics — and only show a visible challenge when something looks suspicious. That means a CAPTCHA is usually a symptom: the site decided your traffic looked automated. Often the cheapest fix is to look less automated in the first place (more on that in the proxies section), and only solve the challenge when it is genuinely unavoidable.
The Main Types of CAPTCHA
Knowing the type in front of you determines which tool and which pricing tier you need. The most common families today are:
Classic text and image-to-text
Distorted letters, numbers, math problems, or "code words" rendered as an image. This is the original format and the easiest for modern Optical Character Recognition (OCR) and neural networks to read, frequently in a second or two.
Image-selection grids
The familiar "select all squares with traffic lights" format. The two dominant providers are Google's reCAPTCHA v2 and the privacy-focused hCaptcha, which uses similar grids trained on different datasets and is common on Cloudflare-protected sites.
Invisible / behavioral scoring
These show no puzzle at all. They watch how you interact with a page and assign a hidden risk score. reCAPTCHA v3 and Cloudflare Turnstile are the leading examples; Turnstile is free and often resolves with a single click or no interaction at all.
Slider and puzzle-piece
You drag a piece into a gap or slide a control into place, and the system analyzes the trajectory, speed, and small hesitations of your movement. GeeTest is the best-known provider and is especially common on Asian websites.
Rotation and 3D interactive puzzles
FunCaptcha, from Arkose Labs, is the gamified, interactive family: rotate an animal or object until it is upright, match dice, identify objects in 3D scenes, and so on. Arkose maintains well over a thousand puzzle variants and adds more constantly, which is exactly why it is the hardest category for purely automatic solvers — variety defeats narrow models. These challenges guard high-value logins on services like X (Twitter), Microsoft, and LinkedIn.
Audio
An accessibility fallback that plays a short recording of spoken words or digits. It can be solved with speech-to-text engines or by a human listener, and remains a useful path on legacy login forms.
Proof-of-work and privacy-first
Newer, puzzle-free options such as Friendly Captcha and ALTCHA make the browser quietly perform a small computational task. The goal is to burn a bot's resources at scale while staying invisible and privacy-compliant for ordinary users.
Enterprise and WAF-level systems
At the top end sit full bot-management products: reCAPTCHA Enterprise, hCaptcha Enterprise, AWS WAF CAPTCHA, and DataDome. These layer JavaScript execution, fingerprinting, TLS checks, and behavioral scoring, sometimes with a visible challenge on top. They are the toughest to get past and narrow the list of services that can reliably help.
How a Solving Service Actually Works
For token-based challenges (reCAPTCHA, hCaptcha, Turnstile, FunCaptcha, GeeTest) the pattern is consistent:
- Your code detects the challenge on the page and extracts its parameters — typically the site key and the page URL.
- You submit those parameters to the solving service through its API, usually creating a "task" and receiving a task ID.
- You poll for the result until the service returns a valid response token (or, for some challenges, click coordinates).
- You inject that token back into the page or send it with your request, and the target site accepts it.
For classic image and text CAPTCHAs, you simply upload the image and get back the recognized text. The important subtlety with token-based systems is session consistency: the solved token often has to match the browser session, user agent, and IP that requested it. Solve a CAPTCHA from one IP and submit it from another and the target may reject it.
The Two Solving Philosophies
Every solving method, and therefore every service, falls into one of two broad camps — and many modern services blend them.
Automatic (OCR / AI). Software or cloud models recognize the challenge without human involvement. This is fast and cheap and excels at high-volume, repetitive tasks (text, image grids, Turnstile). Its weakness is novelty: when a provider changes its challenge logic or rolls out an unusual variant, accuracy can drop until the model is retrained.
Human-powered. Real workers solve the challenge in real time. This is slower (often ten seconds or more) but can handle almost anything visual, including brand-new formats that no model has been trained on yet. It is the traditional safety net for the hardest puzzles.
In 2026 the line between them has blurred. Services that were historically "human" now run AI first and fall back to people only for rare or difficult tasks, while "AI-first" services keep a small human pool in reserve. As a rule of thumb: automatic services win on speed and price for common challenges; human-backed services win on coverage for the weird and the new.
Rotating Proxies: Why They Belong in This Conversation
A solver removes the challenge in front of you, but it does nothing about why the challenge appeared. The single biggest trigger is a bad or overused IP address. This is where rotating proxies come in.
A rotating proxy pool assigns a different IP to your requests on a schedule or per request, so traffic looks like it comes from many ordinary users rather than one machine hammering the site. Residential and mobile rotating proxies are the most effective because their IPs belong to real households and carriers, which earns a low risk score. Pairing rotating residential proxies with a consistent, realistic browser fingerprint and human-like request pacing keeps your score low enough that many CAPTCHAs never fire at all — which is cheaper and more reliable than solving them after the fact.
Two practical points. First, some token-based challenges require you to pass your own proxy to the solver so the solved token is bound to the right IP; check each service's documentation for which task types need this. Second, "rotating" cuts both ways: rotate too aggressively mid-session and you can break the session consistency that token-based CAPTCHAs depend on. Stable per-session IPs plus rotation between sessions is usually the right balance.
CAPTCHA-Solving Services Worth Knowing
The two services most often missing from older roundups are 2Captcha and Anti-Captcha, so we start there. After that we group the rest by their primary approach. Pricing and exact capabilities change frequently, so always confirm current details on each provider's own site and documentation.
Human-backed and hybrid services
2Captcha — One of the most widely integrated services on the market and a sensible default for breadth of coverage. It began as a human-powered service and now runs AI first with a human fallback for harder or unusual tasks. It supports a very wide list of challenge types — reCAPTCHA (v2, Invisible, v3, Enterprise), hCaptcha, Cloudflare Turnstile, GeeTest (including v4 sliders), FunCaptcha, image rotation, click and grid CAPTCHAs, audio, AWS WAF, and region-specific systems such as Yandex — and you pay only for solved CAPTCHAs. Official SDKs and code samples exist for Python, PHP, JavaScript, Go, Ruby, Java, C#, and C++. A live demo of many CAPTCHA types is available on their site, and client libraries are published on their GitHub organization.
Anti-Captcha — A market veteran operating since the late 2000s, primarily human-powered with machine learning used for routing and pre-processing. Documentation is clean, the API is stable, and the service is known for high parallelism and throughput. It covers essentially every popular type, including reCAPTCHA v2/v3/Enterprise, hCaptcha (including Enterprise), Turnstile, GeeTest standard and v4, and FunCaptcha. A notable extra is Custom Tasks, where you describe an arbitrary job through the API and workers carry it out. Browser extensions for Chrome, Firefox, and Safari simplify some workflows, and official clients are listed on the site.
DeathByCaptcha — A long-running hybrid of OCR and human solvers (active since 2009). The mix delivers faster average solve times than human-only services while keeping accuracy reasonable, and the API has historically supported a wide range of languages. Today it covers reCAPTCHA v2/v3 (including Invisible), hCaptcha, FunCaptcha, GeeTest v3/v4, Turnstile, plus less common systems like KeyCaptcha, Capy Puzzle, Lemin, AWS WAF, and audio CAPTCHAs. We previously wrote a walkthrough of using DeathByCaptcha from C#.
SolveCaptcha — A newer universal service (launched in 2025) offering both a cloud API and a Chrome/Chromium extension, combining AI recognition with human decoders. It advertises near-complete coverage: reCAPTCHA (classic, Invisible, Enterprise, callback modes), hCaptcha, FunCaptcha, Turnstile, GeeTest including v4, AWS WAF, sliders, text riddles, and arithmetic challenges, with a claimed success rate in the 95–99% range.
9kw.eu — A community-driven service with a two-sided model: you can earn credits by solving submitted CAPTCHAs, or spend credits (or buy them) to have your own solved. Everything is accessible through the API, and a Chrome extension is available for remote solving. Throughput is modest and solve times are not the fastest, so it suits low-volume or budget-sensitive workflows.
ImageTyperz — A long-standing human-labor service (client portal here) with APIs and examples for .NET, PHP, Java, C/C++, Perl, iMacros, a command-line tool, and C# HTML posting. It performs well on image-based CAPTCHAs and is affordable, though its coverage of the newest token-based challenges is narrower than the AI-first leaders.
Automatic (AI / OCR) services and software
CapSolver — An AI-first service focused on the modern stack: reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, GeeTest, AWS WAF, and image-to-text. It is fast and competitively priced, and it has invested heavily in Cloudflare support, which makes it a strong pick for Turnstile-heavy and Cloudflare-protected targets. Integration details and code samples live in its documentation.
CapMonster Cloud — A pure-AI cloud solver from ZennoLab, built for high volume at low cost and known for speed on modern challenges like Turnstile. It uses a clean JSON API, ships browser extensions for Chrome and Firefox, fits naturally alongside Puppeteer, Selenium, and Playwright, and includes proxy for many task types. Its current supported-types documentation now includes FunCaptcha, DataDome, GeeTest, and several Cloudflare modes.
GSA Captcha Breaker — A Windows OCR application that recognizes a large catalogue of classic CAPTCHA types locally, on your own machine, and forwards only the hardest cases to paid online services. As a one-time desktop purchase it can reduce per-solve costs for text and image CAPTCHAs, though it is not aimed at the newest token-based systems. We covered it in an earlier GSA Captcha Breaker review.
AZcaptcha — A budget-oriented automatic solver supporting reCAPTCHA v2/v3, hCaptcha, and a very large set of image-based CAPTCHAs, with both pay-per-solve and flat-rate "unlimited" plans that can save money on steady high-volume workloads. It offers a simple API and Chrome/Firefox extensions.
NopeCHA — Popular largely through its browser extension, which makes it convenient for browser-based and semi-manual workflows; an API is available too, though it is less geared toward heavy backend automation at scale.
Bright Data Web Unlocker — Rather than a standalone solver, this is an "unlocking" product that combines CAPTCHA handling with IP rotation, JavaScript rendering, and automatic retries on top of a very large proxy network. It is a fit when you want CAPTCHAs handled as part of a broader anti-blocking pipeline rather than as a separate API call.
Older tools that shaped the market
Several names from earlier guides — DeCaptcher (review), BypassCaptcha (review), Captcha Sniper, and ExpertDecoders — helped define the early decaptcha ecosystem, with DeCaptcher offering multi-language OCR APIs and Captcha Sniper intercepting requests to other services to solve them locally. Some of these are no longer actively maintained or have been overtaken by the AI-first and hybrid services above. We keep the references here for completeness, but for new projects we recommend the actively developed options.
Client Libraries and SDKs
You rarely need to talk to these APIs by hand. The major providers publish official client libraries and code samples:
- 2Captcha — official clients for Python, PHP, JavaScript, Go, Ruby, Java, C#, and C++ on its GitHub organization (for example, the Python client
2captcha-python). - Anti-Captcha — official and community clients for Python, PHP, JavaScript, Java, C#, and more, listed on the clients page.
- CapSolver and CapMonster Cloud — REST/JSON APIs with examples for popular languages and browser-automation frameworks in their respective docs (CapSolver docs, CapMonster docs).
Because most of these services share a similar "create task → poll for result" flow (and several are deliberately compatible with the 2Captcha or Anti-Captcha API schemes), switching providers usually means changing an endpoint and a key rather than rewriting your integration.
Can General-Purpose AI Solve CAPTCHAs Now?
This is the biggest shift since the original version of this article. Multimodal large language models — ChatGPT (OpenAI), Claude (Anthropic), DeepSeek, Gemini, and others — can read images and reason about them, and they handle some CAPTCHA tasks surprisingly well. Distorted text, simple math puzzles, and "pick the squares containing X" object-recognition grids fall within reach of a capable vision model, and the dedicated solving services themselves now lean heavily on this kind of AI for their automatic tiers.
That said, general chatbots are not a drop-in replacement for a purpose-built solver, for several reasons:
- They don't manage the token round-trip. reCAPTCHA, hCaptcha, and Turnstile hand back a response token bound to a site key, session, and IP. A model that "reads" the picture still doesn't produce a valid, session-matched token by itself — that orchestration is what the solving services provide.
- Interactive and behavioral challenges defeat them. FunCaptcha's rotating 3D puzzles, GeeTest's trajectory analysis, and invisible behavioral scoring depend on how you interact, not just on recognizing an image. Pure recognition isn't enough.
- Reliability and rate. For live, high-volume scraping, a general chatbot is slower, less consistent, and not designed for the throughput that purpose-built AI solvers and human pools deliver.
- Guardrails and policy. Many AI providers restrict or refuse CAPTCHA-defeating requests, and using them this way may conflict with both their terms and the target site's.
The realistic 2026 picture: AI now comfortably handles classic text, image grids, and much of reCAPTCHA/hCaptcha/Turnstile through specialized solvers; the genuinely hard categories — FunCaptcha and full bot-management systems like DataDome and reCAPTCHA Enterprise — still benefit from human workers or sophisticated browser emulation. Expect general models to keep absorbing more of the easy and medium tiers over time.
Conclusion
CAPTCHA solving still divides into the same two foundations it always has — automatic recognition and human labor — but the proportions have flipped. AI and OCR now clear most common challenges quickly and cheaply, while human-backed services have become the specialist tier for novel, interactive, and high-value puzzles, and most leading providers blend both. Just as important, the smartest strategy is often not to solve at all: rotating residential proxies, clean fingerprints, and human-like pacing prevent many CAPTCHAs from ever appearing, leaving the paid solver for the genuinely unavoidable cases. Choose your tool by the type of challenge you face and the scale you operate at — and always stay on the right side of each site's terms and the law.