5 min read
Also: hCaptcha Enterprise, h-captcha-response, Intuition Machines CAPTCHA, hcaptcha.com, h captcha
hCaptcha
Quick answer
hCaptcha is a privacy-focused CAPTCHA and bot-detection service by Intuition Machines that shows image challenges or runs passively, then lets the site verify the token through its siteverify API. For development, the test site key 10000000-ffff-ffff-ffff-000000000001 with the all-zero secret 0x0000000000000000000000000000000000000000 always passes; to compare it with Google's option, see reCAPTCHA.
hCaptcha is a privacy-focused CAPTCHA and bot-detection service by Intuition Machines. It shows image challenges or runs passively, issues a token, and lets the site verify it server-side through its siteverify API.
Last verified
What people do with hCaptcha
- Compare hCaptcha with reCAPTCHA
Privacy, pricing and how each scores visitors.
- Compare hCaptcha with Cloudflare Turnstile
The free Cloudflare widget many sites moved to.
- Learn the CAPTCHA types and why you see them
Image grids, checkboxes and invisible checks.
- Automate a form protected by hCaptcha
Autonoly can solve hCaptcha when CAPTCHA solving is enabled.
- Automate job application forms
Application portals are a common place to meet hCaptcha.
- Why automated browsers get more challenges
The browser and network signals that raise risk scores.
Key facts
| Made by | Intuition Machines, Inc. |
|---|---|
| Notable adoption | Cloudflare switched its challenges from reCAPTCHA to hCaptcha in April 2020 (later replaced by Turnstile) |
| Plans | Free (Basic/Publisher), Pro (self-serve, from $99/month on annual billing), Enterprise (quote) |
| Passive mode | Pro and Enterprise; fully passive no-CAPTCHA mode and risk scores on Enterprise |
| Server-side check | POST token + secret to api.hcaptcha.com/siteverify; tokens are single-use |
| Form field | h-captcha-response |
What is hCaptcha?
hCaptcha is a CAPTCHA and bot-detection service made by Intuition Machines, Inc., a US company. It is the main independent alternative to Google reCAPTCHA, and its best-known challenge is a grid of images with a prompt such as "Please click each image containing a boat". hCaptcha positions itself around privacy: it is not tied to an advertising business, and it markets compliance with privacy regimes such as GDPR as a reason to choose it over Google.
hCaptcha's profile rose sharply in April 2020, when Cloudflare announced it was moving its own challenge pages from reCAPTCHA to hCaptcha, citing privacy, availability and above all cost. Cloudflare later replaced its CAPTCHAs with its own Turnstile technology, but by then hCaptcha was embedded on a large number of sites and apps, including many Discord, ticketing and crypto sign-up flows.
How hCaptcha works
From a developer's point of view hCaptcha was designed to look very much like reCAPTCHA, so switching is mostly a matter of changing a script tag and keys:
h-captcha-response.https://api.hcaptcha.com/siteverify) and accepts the form only if the response says success: true. Tokens are single-use and expire quickly, so they cannot be stored and replayed.Enterprise customers can also receive a risk score with each verification instead of relying only on pass/fail.
Plans
hCaptcha publishes three tiers:
Request allowances and prices change; check hcaptcha.com/pricing rather than third-party summaries, which disagree with each other.
Test keys
hCaptcha publishes keys for development and automated tests. With the site key 10000000-ffff-ffff-ffff-000000000001 (Publisher and Pro accounts) and the secret 0x0000000000000000000000000000000000000000, the widget always passes and siteverify accepts the resulting test token. Enterprise accounts have separate test keys, such as 20000000-ffff-ffff-ffff-000000000002. Never ship test keys to production: they accept every submission. The hCaptcha developer guide lists the current set.
Where you meet hCaptcha in automation
People automating browsers run into hCaptcha mainly on:
Common problems:
requests script or Google Sheets IMPORTXML cannot produce a token.Using automation responsibly around hCaptcha
hCaptcha on a form means the operator does not want unattended bots submitting it. The better options are the site's API or export, a partner arrangement, or a person handling the verification step for accounts you own. Read the site's terms and robots.txt before scraping, and see our guide on whether web scraping is legal. A workflow that triggers CAPTCHAs constantly is usually going too fast or doing something the site does not permit.
hCaptcha and Autonoly
Autonoly runs a real headed Chromium browser. When CAPTCHA solving is enabled, the agent can solve hCaptcha challenges it encounters during a run, the same as reCAPTCHA v2. When it is disabled, or a challenge cannot be completed, the agent pauses and hands you the browser through live browser control so you can answer it yourself, then continues. Autonoly does not use proxies or rotate IP addresses, and it does not promise to get past every challenge.
Why It Matters
hCaptcha is the most common CAPTCHA after reCAPTCHA, especially on sign-up, community and crypto sites. Knowing how its token and siteverify flow work, and what makes it escalate, helps you design automations that meet it rarely and handle it honestly when they do.
How Autonoly Solves It
With CAPTCHA solving enabled, Autonoly's agent can solve hCaptcha challenges in its real Chromium browser. If solving is off or a challenge cannot be completed, it hands you the live browser to answer it yourself. Autonoly does not use proxies or IP rotation.
Learn moreExamples
An agent registering an account on a community site meets an hCaptcha image grid; with CAPTCHA solving enabled it completes it and continues
A developer's form automation fails with 'invalid captcha' because the h-captcha-response field was submitted empty
A site owner moves from the free tier to Pro to use passive mode so fewer real visitors see image puzzles
Frequently Asked Questions
Who makes hCaptcha?
hCaptcha is made by Intuition Machines, Inc., a US company. It is independent of Google and markets itself on privacy, which is one reason sites choose it over reCAPTCHA.
Is hCaptcha free?
There is a free tier for small and non-commercial sites. Pro is self-serve and marketed from $99 per month on annual billing with passive mode, and Enterprise is quote-based. Allowances and prices change, so check hcaptcha.com/pricing directly.
What is the difference between hCaptcha and reCAPTCHA?
They work the same way for developers: a widget, a token and a server-side siteverify call. The differences are the owner (Intuition Machines versus Google), the privacy positioning, pricing, and the challenges themselves. hCaptcha was built to be easy to swap in for reCAPTCHA.
Does Cloudflare still use hCaptcha?
Not for its own challenges. Cloudflare moved from reCAPTCHA to hCaptcha in April 2020, then replaced CAPTCHAs on its platform with its own Turnstile and managed challenge technology. Individual sites behind Cloudflare can still embed hCaptcha in their forms.
Why does hCaptcha give my automated browser so many challenges?
hCaptcha raises difficulty for sessions that look risky: fresh profiles without history, automation traits from headless or DevTools-driven browsers, datacenter IPs and fast repeated requests. Slowing down, using an official API, or handling the step manually are the honest fixes.
Can Autonoly solve hCaptcha?
Yes, when CAPTCHA solving is enabled. Otherwise, or if a challenge fails, the agent hands you the live browser so you can complete it yourself and then lets the run continue.
Further reading
Related terms, automations and guides
Where this concept shows up in practice.
Stop reading about automation.
Start automating.
Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.