hCaptcha solver

hCaptcha looks like reCAPTCHA v2 but behaves differently: the challenges are generated by a different service, the sitekey format is different, and the token has to go into a field named h-captcha-response or hcaptcha-response. Our API returns that token from the sitekey and page URL.

How hCaptcha differs from reCAPTCHA

The sitekey is a UUID style string, not a 40-character Google key
The token field is named h-captcha-response rather than g-recaptcha-response
Challenge images are served by hCaptcha, so a reCAPTCHA trained model does not transfer
Checkbox challenges are extremely common, more so than on reCAPTCHA
An invisible mode exists that runs with no widget at all

The three forms you will meet

Checkbox: a box to tick, which may then escalate into an image grid
Invisible: no widget, token requested programmatically by the page
Enterprise: the same service with extra site configuration and stricter validation

The two ways to solve it

Token endpoint: sitekey plus URL in, a submittable token out. This is what you want when the page expects a response field to be filled.
Image endpoint: returns which tiles to click or what the image says, and you perform the interaction yourself. Useful when you are already driving a real browser.

Reading the challenge out of the page

The sitekey sits in a div with the class h-captcha, usually as data-sitekey, or it is passed to hcaptcha.render in an inline script. If the widget is inside an iframe, read the iframe src and take the sitekey from the query string. The URL parameter should be the page URL that hosts the challenge, because validation is tied to it.

Submitting the token

Locate the textarea named h-captcha-response, write the token into it, and dispatch input and change events before submitting the form. In invisible mode the page normally exposes a callback that expects the token as its argument; call that instead of touching a field.

Pricing and failure handling

One credit per accepted solve, and polling is free. A submission the upstream refuses is not billed. If the site raises difficulty and rejects a token, that is a site-side decision rather than a recognition failure, so the practical response is to request a fresh token rather than to retry the same one.

How to integrate

curl -X POST https://fuckcaptcha.top/v1/token/hcaptcha \\
  -H "Authorization: Basic $NSK_KEY" \\
  -d '{"sitekey":"<sitekey>","url":"<page url>"}'

Pricing

Charged per solve: one credit for each recognition request, and polling for the result is free. Signing up includes 200 free solves.

FAQ

Can I use this to bypass hCaptcha?

You send the sitekey and page URL and receive a valid token, which you hand back to the page exactly as a real visitor would. That is the supported route and it works for checkbox, invisible and enterprise deployments.

How is the token returned?

The polling response contains the token string, which goes into the field named h-captcha-response or the page callback, depending on how the site was set up.

Does the extension handle it without any code?

Yes. The browser extension recognises hCaptcha in the page and fills the response in automatically, drawing on the same allowance as the API.

What if I only get error 11 back?

Error 11 is a rate limit. It is usually caused by submitting too many jobs at once from one key, so lower the concurrency and space the requests out.

Is there a free tier?

New accounts include 200 free solves, and polling never costs anything, so you can test a full integration before paying.

Read the API reference Download the Chrome extension