Best CAPTCHA-solving services for web scraping

Here's the thing nobody selling a solver leads with: most of the CAPTCHAs you're hitting are your own doing. Not a moral failing. A signal. The site looked at your IP and your browser, decided you smelled automated, and threw a puzzle to confirm it. Solve that one puzzle and you've treated the symptom while the disease keeps flaring on every request.

So this guide runs in two halves. First, why a solver is the last tool you reach for, not the first. Then, once you've earned the right to buy one, how the services actually differ and how to choose without lighting money on fire. I run scrapes for a living and pay these invoices monthly, so this is the version I wish someone had handed me before my first bill.

Do this before you pay for a solver

A CAPTCHA is a site telling you it already doesn't trust you. That's the whole mental model. reCAPTCHA v3 and Cloudflare Turnstile don't even show a puzzle most of the time. They read your reputation in the background and wave through anything that looks ordinary. So the cheapest solve is the one you never trigger.

Two changes kill most challenges before they appear:

• A clean residential IP. Datacenter ranges are pre-scored as suspicious, and a bad IP on its own can drop your v3 score low enough to force a puzzle that a good IP would've skipped. We go deep on picking a pool in the residential proxy guide.
• A real browser that spoofs at the source. A genuine fingerprint clears invisible challenges far more often than a headless-looking one does. Camoufox is the tool I reach for; if you're weighing it against the Chromium route, here's the comparison.

Get those two right and a big share of your challenges just stop happening. What's left, the visible puzzles that survive a clean setup, is what a solver is actually for. Pay to solve those. Don't pay to solve the ones you could've dodged for the price of a better proxy.

The challenges you'll actually hit

Not all challenges cost the same to beat. Here's what you'll run into, easy to nasty, so you know what you're quoting before you shop.

• reCAPTCHA v2 (checkbox and image grid). The classic "I'm not a robot" tick, and the "select all the buses" grid behind it. Cheap and reliable to solve. Human farms handle these in their sleep.
• reCAPTCHA v3 (score, no click). No puzzle at all. It hands the site a score from 0.0 to 1.0, tied to an action name and your reputation. You don't solve v3, you need a token that scores high enough, and that score leans hard on the IP it was minted from. This is exactly where cheap "proxyless" solving falls apart.
• hCaptcha. Image puzzles, a close cousin of v2 to solve. Common on privacy-minded sites. Farms and automated services both do fine on it.
• Cloudflare Turnstile. Mostly a background browser and proof-of-work check that returns a token, not an image puzzle. A real browser passes it more often than a solver does, so try the browser route first. More on that in the Cloudflare guide.
• GeeTest and DataDome sliders. Slide-the-piece puzzles backed by behavior scoring. Harder, and DataDome especially is more a device-trust wall than a puzzle. Often cheaper to dodge than to solve.
• FunCaptcha / Arkose Labs. Rotating 3D image puzzles ("turn the animal upright") guarding high-value logins on social and gaming platforms. The hard ceiling. Slower, several times pricier per solve, and the one I quote clients extra for.

Rough hardness order, cheapest to worst: reCAPTCHA v2 and hCaptcha, then Turnstile if you must solve it rather than pass it, then GeeTest, then reCAPTCHA v3 at scale, then Arkose. Price and failure rate climb the same ladder.

Two kinds of service: farms vs token APIs

Two business models sit behind almost every service, and they're good at different jobs.

Human-solver farms. Real people in front of screens, solving puzzles through an API, billed per thousand solves. Cheap. Slower, because there's a person and a queue, so expect seconds to tens of seconds under load. Still unbeatable on the odd image sets a model fumbles. 2Captcha and Anti-Captcha are the names you'll see here.

Automated token services. Software does the solving, so they're fast and they scale, and they're the better answer for the token-shaped challenges: reCAPTCHA v3 scores, Turnstile, invisible v2. Pricier per solve than a farm on average, but the latency is where they earn it back. CapSolver and CapMonster live in this camp.

Most large providers now bolt both together under one API and one balance, routing each task to whichever backend fits. So you mostly don't pick a model. You pick a provider whose routing and success rate hold up on your target.

How the integration works

The API shape is nearly identical across providers, which is the one genuinely nice thing about this corner of scraping. Three steps.

1. Submit the task. Hand over the challenge's sitekey (the data-sitekey in the page markup) and the page URL. For v3 you add the action name and a minimum score; for Turnstile, the action. For anything reputation-sensitive, you also pass a proxy so the token is minted from your IP, not the farm's.
2. Poll for the result. The job goes into a queue. You poll every few seconds until a token comes back.
3. Use the token. Drop it into the hidden field the page expects (usually g-recaptcha-response) or feed it to the JavaScript callback, then submit the form.

In code, kept provider-neutral. The createTask / getTaskResult pattern below is the de facto standard, so most services take this shape:

import requests, time

API = "https://api.captcha-provider.example/v1"
KEY = "YOUR_API_KEY"

# 1. Submit the task: what to solve, and where.
job = requests.post(f"{API}/createTask", json={
    "clientKey": KEY,
    "task": {
        "type": "RecaptchaV2TaskProxied",
        "websiteURL": "https://target.example.com/login",
        "websiteKey": "6Lc_sitekey_from_the_page",
        # v3 also needs "pageAction" + "minScore"; Turnstile needs the action
        "proxyType": "http",
        "proxyAddress": "gate.example-proxy.com",
        "proxyPort": 8080,
        "proxyLogin": "user",
        "proxyPassword": "pass",
    },
}).json()
task_id = job["taskId"]

# 2. Poll until a worker (or a model) returns the token.
while True:
    time.sleep(5)
    res = requests.post(f"{API}/getTaskResult", json={
        "clientKey": KEY, "taskId": task_id,
    }).json()
    if res["status"] == "ready":
        token = res["solution"]["gRecaptchaResponse"]
        break

# 3. Inject the token where the page wants it, then submit.
#    Usually a hidden <textarea name="g-recaptcha-response"> or a JS callback.
session.post("https://target.example.com/login", data={
    "username": "...", "password": "...",
    "g-recaptcha-response": token,
})

That's the whole dance. One thing to remember: the token is short-lived, usually a minute or two, so solve right before you submit, not ahead of time and definitely not in a batch you sit on.

The proxy catch nobody mentions

Here's the trap that burns everyone exactly once. A token isn't portable across IPs. reCAPTCHA v3 and Turnstile bake reputation, and often the requesting IP, into the token. So if a farm solves it from some datacenter box in another country and you submit from your residential proxy, the two don't line up and the site rejects a token it just handed out. Works in the provider's playground, fails in your pipeline. It's this, every single time.

The fix is a "proxied" task: you pass your own proxy into the solve request so the token is generated from the same IP that'll use it. It costs a little more than the "proxyless" option, and it's worth every cent on v3 and Turnstile. For plain image puzzles like v2 or hCaptcha, proxyless is usually fine, because there's no IP baked into the answer. Keeping that proxy pool healthy is its own job, covered in the rotating proxies walkthrough.

What actually matters when you pick one

Ignore the marketing success rates. They're measured on the vendor's easiest path, not on your target. What actually decides it:

• Success rate on your site. Buy a few dollars of credit and run 100 solves against your real target before you commit to anyone. This is the only number that counts, and it's cheap to get.
• Latency at p95, not average. A service that averages 8 seconds but spikes to 90 will stall your whole run. Watch the tail, not the mean.
• Price per thousand, by type. Quotes vary and move, but as a ballpark you're looking at roughly $0.5 to $3 per 1,000 for common image and token challenges, with Arkose and DataDome running several times that. Confirm the current rate yourself; these change.
• Type coverage. Check they support your exact challenge, not just "reCAPTCHA" in the abstract. v2 and v3 are different products with different endpoints.
• Proxy support. If you're solving v3 or Turnstile, proxied tasks aren't a nice-to-have. They're the difference between working and not.

My take: don't overthink the first pick. Grab one that covers your challenge type, benchmark it on your target for an afternoon, and switch if the numbers disappoint. Switching costs almost nothing because the APIs all rhyme. Loyalty to a solver is how you overpay.

When not to pay to solve

Half the value of doing this for years is knowing when the solver is the wrong answer. Four cases where you should keep your wallet shut:

• The challenge is invisible and dodgeable. If it's v3 or a managed challenge and a clean IP plus a real browser clears it silently, you're paying to solve a puzzle you never needed to see. Fix the upstream layers instead. The full anti-bot checklist walks every one of them.
• You're scraping public pages, not logging in. Most CAPTCHAs live on login, signup, and checkout. If the job is public data, don't wander into the gated flows that trigger them in the first place. Scraping behind a login covers the times you genuinely do need the account.
• The volume is trivial. Ten solves, total? Do them by hand. An API account and a polling loop aren't worth the setup for a one-off.
• It's Arkose or DataDome on a hardened target. Solving these is brittle and expensive, and a service that works this week may fold next week when the target rotates its puzzle. Fix the fingerprint, rethink the scope, or budget for real pain. Throwing solver money at a hardened wall rarely ends well.

FAQ

How much does CAPTCHA solving cost?

You pay per solve, quoted per 1,000. Common image and token challenges run roughly $0.5 to $3 per 1,000, and the nasty ones (Arkose, DataDome) cost several times more. Rates shift between providers and over time, so treat any figure as a checkpoint, not a promise. At real volume your bill is dominated by how many challenges you trigger, which loops right back to fixing your IP and browser so you trigger fewer of them.

Are CAPTCHA-solving services legal?

Paying a service to solve a puzzle in front of public data is broadly fine in a lot of places, and using one doesn't change the legality of the scrape itself either way. But the site's terms of service, its robots rules, rate limits, and privacy law all still apply, and they vary by where you and the site sit. This isn't legal advice. If a project is high-stakes, talk to a lawyer before you point anything at someone's servers.

Which is best for reCAPTCHA v3?

An automated token service running a proxied task, with your residential proxy passed in and the correct action name and minimum score set. v3 is a reputation score, not a puzzle a human clicks, so a human farm has no edge here, and a token solved from a mismatched IP scores badly and gets rejected. The IP the token is minted from matters more than the service brand.

Can I avoid CAPTCHAs entirely?

Not always, but you can dodge most of them. A clean residential IP and a real browser like Camoufox make the invisible challenges resolve silently, and staying out of login and checkout flows keeps you away from where the visible ones live. The residue that survives a clean setup is the only part a solver should ever touch.