ilovecaptcha.com

Automated CAPTCHA solving API

ilovecaptcha resolves CAPTCHA challenges automatically through a REST API, built for scraping, testing and browser automation pipelines. Send the challenge, receive the result, and keep your workflow running without manual intervention.

View the 15 supported CAPTCHA types
In development — no launch date announced

Published 1 August 2026 · Last updated · Written and maintained by the ilovecaptcha team

What is ilovecaptcha?

ilovecaptcha is a REST API that solves CAPTCHA challenges automatically. A client sends the challenge parameters over HTTPS, the solving engine processes them, and the API returns the token or text the target site expects. It is aimed at developers who hit CAPTCHA walls inside automated test suites, monitoring jobs and data-collection pipelines. The service targets 15 CAPTCHA and bot-verification systems, exposes a single JSON interface for all of them, and is currently in development: the site you are reading is the reference source for its status.

Why is automated CAPTCHA solving needed?

Because a CAPTCHA stops an unattended pipeline dead, and because solving one costs real time. Cloudflare measured an average of 32 seconds per challenge and, extrapolating to 4.6 billion internet users seeing roughly one CAPTCHA every ten days, estimated the global cost at about 500 human years per day. In a scheduled test run or a nightly crawl there is nobody to hand the puzzle to: the job fails, and the failure has nothing to do with the code being tested.

  • 32 s average time to complete one CAPTCHA, measured by Cloudflare (May 2021)
  • ~500 years of human time spent on CAPTCHAs every day, per Cloudflare's estimate
  • 15 CAPTCHA and bot-verification systems targeted by ilovecaptcha

The accessibility cost is documented too. In its Group Draft Note Inaccessibility of CAPTCHA, published on 16 December 2021, the W3C Accessible Platform Architectures Working Group writes:

“The very nature of the interactive task inherently excludes many people with disabilities, resulting in a denial of service to these users.”

The industry itself is moving away from the interactive puzzle. According to Cloudflare, Turnstile was announced on 28 September 2022 as a privacy-preserving alternative, and by September 2023 Cloudflare had replaced every CAPTCHA it issued with that widget. Automation still has to deal with all the systems already deployed across the web, which is what this API is for.

Which CAPTCHA types does ilovecaptcha target?

Fifteen systems, covering the five families of challenge met in practice: checkbox and image grids, non-interactive widgets, sliders, drag-and-drop puzzles and full bot-protection interstitials — from general-purpose vendors as well as the in-house challenges of large platforms. The list below names each system, the vendor behind it and the challenge it serves, with a link to the vendor's own documentation wherever one is published, so the behaviour can be checked at the source rather than taken on trust.

reCAPTCHA v2
Google's checkbox and image-grid challenge, introduced in 2014, including the invisible variant. Google documentation.
hCaptcha
Privacy-first image challenge by Intuition Machines, adopted by Cloudflare in April 2020 and now the most common reCAPTCHA alternative. hCaptcha documentation.
Cloudflare Turnstile
Non-interactive widget that verifies visitors without a puzzle, announced in September 2022. Cloudflare documentation.
GeeTest
Slide, click and icon-matching challenges, widely deployed across Asia. GeeTest documentation.
MTCaptcha
Enterprise, GDPR-compliant CAPTCHA widget used mainly by European sites.
AWS WAF Captcha
The puzzle served by Amazon Web Services' Bot Control, generally available since June 2022. AWS documentation.
DataDome
The interstitial raised by DataDome's bot-protection layer, common on retail and classifieds sites.
keyCaptcha
Drag-and-drop puzzle in which image fragments must be reassembled in the right order.
Capy Puzzle
Slide-to-fit puzzle CAPTCHA, where a piece is dragged into its matching slot.
Lemin
Cropped 3D puzzle challenge, also known as Lemin CROPPED.
Tencent
Tencent Cloud's slider verification captcha, met on Chinese platforms.
Binance
Slider challenge served by the exchange's own verification layer: a piece is dragged into place before a sign-in or a withdrawal continues.
TikTok
The platform's in-house challenges: slide-to-fit puzzle, rotation of an inner image until it aligns with the outer one, and 3D shape matching.
xCaptcha
Bot-protection widget whose task rotates between sessions, so the verification scenario differs from one attempt to the next.
Temu
The marketplace's own challenges: an arced slide whose piece follows an unpredictable path, and a shape selection variant.

Pricing and the average solving time measured for each of these 15 types will be published at launch. No figures are quoted before they have been measured on the production engine.

How does the solving API work?

In three steps, over a single HTTPS connection. You submit the challenge or its site parameters to the API, the engine solves it asynchronously in the background, and your client retrieves the resulting token or text and injects it into the request that was blocked. The submit and retrieve steps are separate so that a slow challenge never holds an HTTP connection open on your side.

  1. Submit the challenge. Send the CAPTCHA, or the site key and page URL it was issued for, to the ilovecaptcha API as a JSON payload.
  2. The engine solves it. The solving engine processes the challenge in the background and stores the result against a task identifier.
  3. Retrieve the result. Poll the task, collect the token or text, and inject it into your target request exactly as a browser would.

How do I integrate the API into my stack?

With plain HTTPS requests and JSON payloads, authenticated by an API key. Any language able to make an HTTP call can drive it, with no SDK to install and no proprietary transport to learn. That keeps the integration to a few lines in an existing client, whether the caller is a Python scraper, a Node.js test runner or a Go worker in a queue.

  • Plain REST/JSON requests over HTTPS, no proprietary transport.
  • Authentication with a single API key, passed per request.
  • Callable from any language: Python, Node.js, PHP, Go, C#, Java, Ruby and others.
  • Asynchronous submit-then-retrieve model, designed for batch and large-scale workloads.

Full API documentation, including endpoint reference, error codes and code samples in at least five languages, will be published at launch.

What counts as acceptable use?

Work you are authorised to perform. The API is built for testing and monitoring your own applications, QA and accessibility automation, availability checks, academic research, and collecting publicly available data in line with the target site's terms and applicable law. Credential stuffing, spam, payment fraud and any activity a target site's terms prohibit are outside the intended scope and will not be supported. The full terms of service will be published alongside the API.

How much does it cost, and when does it launch?

Neither is set publicly yet. Pricing will be announced when the service opens, together with the measured average solving time for each of the 15 CAPTCHA types. ilovecaptcha is in development, no launch date has been committed to, and no pre-order, deposit or waiting list is open. This page, published on 1 August 2026 and updated on 20 August 2026, is where the change will be announced first.

Frequently asked questions

Do I need a browser to use the API?

No. ilovecaptcha is a server-to-server HTTPS API: the caller sends JSON and reads JSON back, so a scraper, a scheduled job or a queue worker can drive it with nothing more than an HTTP client. A headless browser is only needed on your side if your own workflow already uses one to reach the page carrying the challenge — and in that case the browser collects the site key and page URL, while the solving itself still happens through the API.

Which CAPTCHA types does ilovecaptcha support?

Fifteen: reCAPTCHA v2, hCaptcha, Cloudflare Turnstile, GeeTest, MTCaptcha, AWS WAF Captcha, DataDome, keyCaptcha, Capy Puzzle, Lemin, Tencent captcha, plus the in-house challenges of Binance, TikTok, xCaptcha and Temu. Between them they cover the five challenge families met in practice: checkbox and image grids, non-interactive widgets, sliders, drag-and-drop puzzles and full bot-protection interstitials. Each one is described, with a link to the vendor's documentation where one exists, in the CAPTCHA types section above.

How do I integrate the CAPTCHA solving API?

Through REST/JSON calls secured with an API key, from any language that can make an HTTP request. The model is asynchronous: you submit the challenge, receive a task identifier, then poll that task until the token or text is ready. Nothing else is required — no SDK to install, no proprietary transport, no browser extension. Full integration documentation, with endpoint reference, error codes and code samples in at least five languages, will be published at launch.

How much does it cost?

Pricing has not been published. It will be announced when the service launches, together with the average solving time measured for each of the 15 supported CAPTCHA types, so the cost can be weighed against the actual latency rather than against a promise. No pre-order, deposit or waiting list is being taken in the meantime, and no payment detail is collected anywhere on this site.

When does the service launch?

No public launch date has been announced, and none will be committed to before the engine is ready. The service is in development; this page carries a visible last updated date, currently 20 August 2026, and is the first place the change will appear. Following it costs nothing: there is no list to join and no address to leave, because this site collects nothing from its visitors.

Is solving a CAPTCHA legal?

It depends entirely on what you do with it. Testing your own systems, running QA and accessibility automation, and collecting public data within a site's terms is ordinary engineering work; bypassing an access control you have no right to cross is not. That distinction is the caller's responsibility rather than the API's, and the acceptable use section above states plainly what this service is built for and what falls outside it.

Sources

Every figure quoted on this page comes from one of these documents.