CAPTCHA Types in 2026

CAPTCHAs are a moving target. The category has evolved from "type the wavy letters" to invisible behavioral scoring. Understanding which type you face determines whether to solve, avoid, or escalate.

The major types

Type	Visible interaction?	Difficulty	Solving cost
reCAPTCHA v2 (checkbox)	Sometimes (image puzzle)	Medium	$0.50-2/1000
reCAPTCHA v3	Never (invisible score)	Hard	$1.50-3/1000
reCAPTCHA Enterprise	Never	Very hard	$2-5/1000
hCaptcha	Yes (image puzzle)	Medium	$1-3/1000
Cloudflare Turnstile	Usually invisible	Medium	$1.50-3/1000
FunCaptcha (Arkose Labs)	Yes (3D rotation puzzle)	Hard	$3-8/1000
GeeTest	Yes (slide / image)	Hard	$2-5/1000
Image-based custom	Yes	Variable	$1-5/1000
Audio CAPTCHA	Sometimes	Easy	$0.50-1/1000
Text-based (legacy)	Yes	Easy	$0.30-1/1000
Math problems	Yes	Easy	Trivial

Prices are approximate; vary by provider and volume.

reCAPTCHA v2

The "I'm not a robot" checkbox. Two paths:

1. Easy path: Click the checkbox. If Google judges your behavior trustworthy, it passes silently.
2. Hard path: A 9-grid image puzzle ("select all images with traffic lights"). Multiple rounds possible.

Detection signals it uses:

• Mouse movement before clicking the checkbox.
• Browser fingerprint (canvas, WebGL).
• Cookies (recent Google site visits help).
• IP reputation.

Solving approach:

• Use a 2Captcha-style human-solving service ($1-2 per 1000).
• Or, if your scraper is already in Playwright, sometimes the page passes silently with good fingerprint hygiene.

reCAPTCHA v3

Invisible. Runs in the background, computes a score 0.0–1.0 ("very likely bot" to "very likely human"). The site decides what threshold to enforce.

You can't "solve" a v3 challenge, you can only influence the score upward.

Score-influencing factors:

• Time on page before action.
• Mouse / scroll / keyboard activity.
• Browser fingerprint.
• Cookie history.
• IP reputation.

Solving approach:

• Real browser via Playwright with realistic behavior.
• Token-passing services exist (2Captcha will return a token); reliability is variable.
• If the site checks score >0.7 and you can only get to 0.3 from a scraper, the action is rejected even with a "solved" token.

reCAPTCHA Enterprise

The pricier Google product. Same UX as v3 (invisible scoring), more aggressive ML. Used on banking, large e-commerce. Effectively impractical to solve programmatically at scale.

If you must scrape an Enterprise-protected target: commercial unblocker is usually the answer.

hCaptcha

Privacy-focused alternative to reCAPTCHA, used widely on Cloudflare-fronted sites. Image puzzles ("select all images of a dog").

Solving approach: human-solving services. 2Captcha, CapSolver, Anti-Captcha all support it. Cost similar to reCAPTCHA.

The interesting variant: hCaptcha Enterprise is harder, often requires solving with browser context.

Cloudflare Turnstile

Cloudflare's CAPTCHA replacement. Mostly invisible, passes for real browsers, challenges bots. When challenged, sometimes shows a puzzle.

Solving: specialized Turnstile services exist. 2Captcha and CapSolver both support it. The token is short-lived (~2 minutes) so timing matters.

FunCaptcha / Arkose Labs

A 3D puzzle: rotate an object until it matches an orientation. Used by major platforms (Twitter/X, EA, others).

Notably harder than image-based captchas. Computer vision can solve image puzzles; rotating 3D objects in a stable way against constantly-updated challenges is harder.

Solving: specialized services. Costs higher ($3-8/1000). Reliability is the weakest of all major CAPTCHA types.

GeeTest

Chinese-origin; popular on Asian sites. Slide-to-match or image-matching puzzles. Often combined with behavioral analysis.

Solving: specialized services for the Chinese market; major Western solvers also support it.

Image-based custom CAPTCHAs

Smaller sites sometimes roll their own. Quality varies wildly:

• Some are trivially solved by OCR (Tesseract on a Python script).
• Some use distorted fonts that defeat OCR.
• Some are essentially weak reCAPTCHA imitations.

For low-quality customs, OCR scripts cost almost nothing. For higher quality, human-solver services support arbitrary image CAPTCHAs ("send image, return text").

Audio CAPTCHAs

Often offered as accessibility fallback. Distorted speech that you transcribe.

Solving: speech-to-text APIs (Google, Azure) often work surprisingly well. ~$0.50-1/1000. Many sites' audio CAPTCHA is easier to solve than their visual one.

Math and text legacy

What is 5 + 3? or "Type 'PROCEED'". Trivial. Often appears on small sites or as a fallback. Just answer with code.

The invisible-CAPTCHA trap

Modern CAPTCHA (v3, Turnstile, hCaptcha Enterprise) are often invisible, the page renders normally; the action just silently fails or gets blocked. Symptoms:

• Form submits but nothing happens.
• "Please try again" with no error detail.
• The bot is being scored below threshold; the page won't tell you.

Detection in your scraper:

• Compare response between scraper and real browser.
• Watch for missing redirects, missing data.
• Look for invisible CAPTCHA JS in page source (recaptcha-v3.js, hcaptcha-invisible).

If you see invisible CAPTCHA scripts loading, assume you're being scored. No amount of "solving" helps, you need to either pass naturally (browser + realistic behavior) or use an unblocker.

Strategy decision

Situation	Approach
Visible CAPTCHA, low value site	OCR or skip
Visible CAPTCHA, important site	Human-solving service
Invisible v3 / Turnstile, real-browser scraper	Behavior + fingerprint hardening
Invisible Enterprise, business critical	Commercial unblocker
FunCaptcha / GeeTest	Specialized service or rethink the scrape

Cost compounding

A scrape with 5% CAPTCHA encounter rate at $2/1000:

• 100k requests/day × 5% = 5k CAPTCHA events
• 5k × $2/1000 = $10/day = $300/month

Not free. Reducing CAPTCHA rate (via better fingerprinting, slower request rate, residential IPs) saves money even before considering bandwidth.

The "just avoid CAPTCHAs" approach

The ultimate optimization is making CAPTCHAs never fire. Covered in §4.41, but the core lessons are:

• Coherent fingerprints.
• Reasonable request rates.
• Residential IPs.
• Real browser when JS scoring is in play.

A scraper that triggers CAPTCHAs constantly is signaling bot-like behavior; fix the source, not the symptom.

Hands-on lab

Pick a target that uses CAPTCHA (most major sites do):

1. Trigger one by hitting fast from a datacenter IP.
2. Identify the type, open page source, look for recaptcha/turnstile/hcaptcha references.
3. Look up the solving cost for that type.
4. Compute: at your expected volume, what would solving cost monthly?

The number sometimes makes "avoid CAPTCHAs by being better" the obvious answer.