No products in the cart.
hCaptcha
hCaptcha Solver: Solve and Bypass hCaptcha Through a Local API
Hand over a sitekey and a page address, get back a token the form will accept. CapSkip answers hCaptcha checkboxes, invisible widgets and Enterprise keys on hardware you run, with no per-token meter and nobody else's jobs ahead of yours.
Windows x64·Runs locally, so no CAPTCHA leaves your machine
- Checkbox, invisible and Enterprise
- Token, respKey and User-Agent
- Flat monthly price
hCaptcha tokens a month40,000
40.0k250.0k
$84.60stays in your pocketevery month, at this volume
Sign-up forms, login pages, checkouts and ticket queues often put hCaptcha between your script and the submit button. The widget wants a tick, sometimes a round of picture questions, and only then writes a token into the form. CapSkip is an hCaptcha solver that does that part for you: it passes the widget for the sitekey and page you name and replies with the token, so the request your code was about to send goes through.
Solving runs inside the CapSkip app on a workstation, VPS or dedicated box of yours. Picture rounds are answered by models that ship with the app rather than by hired clickers, and nothing about the sites you target leaves your network. A typical solve takes 10 to 30 seconds.
The per-solve services that still sell hCaptcha charge about $3 per thousand tokens, and several of the best-known ones no longer list it at all. CapSkip bills $35 a month per machine and nothing per solve, so a form that asks for a fresh token on every attempt costs no more than one that asks once. Scripts already written for 2Captcha's in.php or for createTask with HCaptchaTask can point at CapSkip and keep their request code.
One token, one form post. hCaptcha tokens are single use and expire after about two minutes, so request each one right before you submit, and send the post under the User-Agent that came back with it. Read the hCaptcha API reference
What the hCaptcha solver handles
Three widget styles
The visible checkbox, the invisible widget that runs when a form submits, and hCaptcha Enterprise all go through one method. Flag an invisible widget with invisible=1 and nothing else changes.
rqdata for Enterprise sites
Some Enterprise sites hand the widget a one-time rqdata value before it runs. Pass it as data, or inside enterprisePayload on createTask, and CapSkip solves with it. Fetch a new one for every task, because it expires within moments.
Token, respKey and User-Agent
Each answer carries the token for h-captcha-response, the respKey hCaptcha issues beside it, and the User-Agent the token was earned with, so your form post can present the same browser identity.
Picture rounds answered locally
When hCaptcha opens an image grid, a drag and drop task or a closed-loop question, models bundled with the app answer it on your hardware. No screenshot of the challenge is sent to anyone.
Your proxy, or none
A proxy is optional. For volume, give the app a proxy list or attach one with each task when the token has to come from a particular network. A proxy on the task always wins over the list.
Fresh tokens at no extra cost
An hCaptcha token is good for one submission and lasts about two minutes. Ask for a new one on every attempt, every retry and every account you create: the monthly plan does not count them.
Three request formats that reach the hCaptcha solver
# pip install capskip
import requests
from capskip import CapSkip
solver = CapSkip(host="127.0.0.1", port=8080) # the machine running CapSkip
result = solver.hcaptcha(
sitekey="a5f74b19-9e45-40e0-b45d-47ff91b7a6c2", # data-sitekey of the widget
url="https://www.example.com/signup", # the page the widget is on
)
# One token per form post, sent under the browser identity that earned it.
requests.post(
"https://www.example.com/signup",
data={"email": "[email protected]", "h-captcha-response": result["token"]},
headers={"User-Agent": result["userAgent"]},
)With the CapSkip Python SDK it is one call: pip install capskip, pass the sitekey and page address to hcaptcha(), and the result carries the token for h-captcha-response and the User-Agent to post the form with.
2Captcha style in.php
POST method=hcaptcha with sitekey and pageurl, poll res.php with the returned id, and read the token after OK|, or as JSON together with respKey and useragent.
createTask with HCaptchaTask
JSON clients send HCaptchaTask, HCaptchaTaskProxyless or the Enterprise pair to /createTask, then read the solution from /getTaskResult as they would with Anti-Captcha or CapSolver.
Any HTTP client
If you would rather skip the SDKs, two HTTP requests from whatever language your scraper is written in are the whole integration. The endpoints run on your machine, so there is no account key to manage unless you turn validation on.
Watch an hCaptcha widget pass
Our hCaptcha test page hosts a genuine checkbox wired to a server-side siteverify check. Point CapSkip at it, paste the token into the form and see the verdict the server receives.
Three steps to a working hCaptcha token
-
Install CapSkip on your machine
Install the app wherever your hCaptcha jobs should be answered, a home PC or a rented Windows VPS, and keep it open. Download CapSkip
-
Start the trial or choose a plan
Plans are priced per machine, never per token. Want to test your own target first? The free trial arrives by email with its own login. Compare the plans
-
Submit a sitekey and page URL
Call in.php or createTask, poll for the result, and post the token with your form using the User-Agent from the reply. Open the hCaptcha docs
Solving hCaptcha locally vs buying tokens one by one
Both routes end with a valid token. They differ in who sees your targets, who answers the picture rounds and what each extra token costs.
| Feature | CapSkip | Per-solve services |
|---|---|---|
| How you pay | $35 a month per machine, however many tokens | About $3 per 1,000 hCaptcha solves, where still offered |
| Who answers picture rounds | Models bundled with the app, on your machine | Remote solvers, often human workers |
| Enterprise and rqdata | Accepted on both in.php and createTask | Often a separate, pricier task type |
| Retries and expired tokens | Included; a failed attempt is retried for you | Every new token is billed again |
| Existing integration | 2Captcha in.php or createTask HCaptchaTask, unchanged | Tied to that provider's endpoint and key |
| Target sites | Never leave your network | Logged by a third party on every task |
Pricing
Stop paying per solve
Choose your license
Bronze License
$35/ month
Instant license activation
Billed monthly. Cancel from your account whenever you like.
Same features. More machines, more throughput.
Every machine solves as fast as its own CPU and memory allow. More machines run more threads at the same time, so Silver solves twice as many CAPTCHAs at once and Gold three times as many.
- Unlimited solving, no daily cap
- Unlimited threads, speed scales with your hardware
- 90% to 100% recognition accuracy
- Drop-in replacement for the major solving service APIs
- Works with almost any tool, no coding required
- REST API, SDKs and a browser extension
- Free training when a new CAPTCHA type appears
- Runs on your machine, nothing leaves it
Every CAPTCHA type CapSkip solves is on every license. See the coverage band
Just want to try it first?
Start with a free 3-day trial and solve 500 CAPTCHAs of any type on your own targets.
How hCaptcha works, and how an API solver gets you the token
hCaptcha is a CAPTCHA service that sites embed as a small iframe, usually the "I am human" checkbox, and a privacy-focused replacement for reCAPTCHA on many sites. When a visitor ticks it, hCaptcha weighs the browser, the network and the behaviour it has seen. A visitor it trusts passes at once. One it doubts gets a challenge: a grid of pictures to pick from, an object to drag into place, or a question about which shapes form a closed loop. A pass writes a long token into a hidden field named h-captcha-response, and the site checks that token with hCaptcha's siteverify endpoint before it accepts the form.
Every widget is identified by a sitekey, a public UUID printed in the page as data-sitekey on the h-captcha div, or passed to hcaptcha.render() when a script builds the widget. Those two values are all an hCaptcha solver needs for a normal widget. An invisible widget, marked data-size="invisible", runs when the form is submitted rather than when a box is ticked; send invisible=1 for it. Enterprise customers can also attach rqdata through hcaptcha.setData(), a short-lived value tied to one challenge that must travel with the task.
Tokens are single use and go stale in about 120 seconds, so request one just before you submit and never cache it. The token is checked together with the context it was earned in, which is why CapSkip names the User-Agent in every reply: send your form post with that header. respKey, returned alongside, is read by a few sites and ignored by most. If a site keeps refusing tokens, check that the sitekey matches the page URL and that you are not posting from an address hCaptcha has learned to distrust.
At volume the network matters as much as the browser. hCaptcha rate-limits and scores addresses, so a steady stream of solves from one IP is exactly what it is built to notice. CapSkip does not force a proxy for hCaptcha, but past a few hundred tokens a day a pool of residential or ISP proxies keeps pass rates steady. Load the pool once in the app, or send a proxy with each task when the token must share an exit IP with your form post.
Browser automation works the same way. In Selenium, Playwright or Puppeteer, read data-sitekey from the page, ask CapSkip for a token, then write it into the hidden h-captcha-response textarea (and g-recaptcha-response, which hCaptcha also fills for compatibility) before you click submit. Sites that register a data-callback expect that function to fire with the token, so call it yourself with the value, exactly as the widget would after a real pass. Because the token was earned in CapSkip's own browser, your automation never has to render a challenge, and a headless session that hCaptcha would distrust never meets one.
Related guides: hCaptcha API reference · hCaptcha demo page · reCAPTCHA v2 solver
Which fields does an hCaptcha task need?
The sitekey of the widget and the full URL of the page it sits on. Add invisible=1 for an invisible widget, data with the rqdata value when an Enterprise site sets one, and optionally a proxy. Everything else, including the browser that earns the token, is handled by the app.
What comes back when the solve finishes?
The token, ready for the h-captcha-response field. With json=1, res.php also returns respKey and useragent; without it, the token follows OK| and the User-Agent arrives in the X-HCaptcha-User-Agent response header. getTaskResult puts the same values in its solution object, the token under both gRecaptchaResponse and token.
Does it work on hCaptcha Enterprise?
Yes. Enterprise widgets are solved through the same method, and createTask also accepts HCaptchaEnterpriseTask and HCaptchaEnterpriseTaskProxyless. When the site passes rqdata to the widget, send it with the task, and fetch a new value each time, because it is issued for a single challenge.
Which existing clients can talk to it?
Anything that speaks 2Captcha or RuCaptcha's in.php with method=hcaptcha, and anything that sends createTask with HCaptchaTask or HCaptchaTaskProxyless, as Anti-Captcha, CapMonster Cloud, CapSolver and SolveCaptcha clients do. The DeathByCaptcha, NextCaptcha and EzCaptcha emulations refuse hCaptcha, so switch those jobs to one of the formats above.
Is hCaptcha available in the extension, SDKs or MCP server?
Yes. hCaptcha is supported in the CapSkip browser extension, the CapSkip SDK packages and the MCP server, as the Python SDK sample above shows, and plain HTTP calls from any language work too.
How long does a solve take?
Usually 10 to 30 seconds, depending on whether hCaptcha asks for picture rounds and how many. Poll res.php every 5 seconds. A failed attempt is retried inside the app before the task reports a result, and that failed attempt is not counted against your licence.
Are proxies required for hCaptcha?
Not to start. One address handles testing and occasional solves. At volume, hCaptcha scores the network as well as the browser, so add proxies under the app's hCaptcha settings, or attach one per task when the solve and the form post must leave from one IP.
Why would a site reject a token CapSkip returned?
The usual causes are an expired token (they last about two minutes), a token used twice, a sitekey that belongs to a different page, or a form post whose User-Agent does not match the one CapSkip reported. ERROR_RECAPTCHA_INVALID_SITEKEY means hCaptcha itself refused the sitekey for that page URL.
Does hCaptcha's invisible mode need anything different?
Only the flag. Send invisible=1 on in.php or isInvisible true on createTask, with the same sitekey and page address. On the page, an invisible widget usually runs from a callback when the form submits, so after placing the token in h-captcha-response, call the site's callback or submit the form the way its own script would.
Can one CapSkip machine handle many hCaptcha jobs at once?
Yes. The number of hCaptcha solves that run in parallel is a setting in the app, limited by memory and CPU rather than by an account quota. Each job is solved on its own, so tokens never mix, and with a proxy list loaded the jobs spread across your addresses.
How much does solving hCaptcha cost with CapSkip?
Nothing per token. You pay for each machine running the app, Bronze being $35 a month for a single one, and every hCaptcha, retry and Enterprise widget comes with it. A free trial is there to prove your target works before you spend anything.
Pass hCaptcha without paying per token
Point your hCaptcha traffic at a CapSkip install of your own and stop counting tokens. Checkbox, invisible and Enterprise widgets, retries included, cost one fixed monthly amount.