CAPTCHAs in 2026: the challenge is the fallback, not the gate

Modern CAPTCHAs such as reCAPTCHA v3, Cloudflare Turnstile and hCaptcha score each visitor invisibly from fingerprint, behavior and reputation, and show a puzzle only when that score is undecided. In 2026 attested devices can skip the check entirely, and declared crawlers are handled by policy or pricing instead.

From score to what the user sees

flowchart TB
    accTitle: From risk score to what the visitor sees
    accDescr: Attested devices pass directly, everyone else is scored from network, TLS, runtime, behavior and history, and only undecided scores get a visible challenge. Declared crawlers are routed to a policy instead.
    IN[visitor] --> PAT{Private Access Token<br/>from an attested device?}
    PAT -->|yes| PASS[pass, no challenge]
    PAT -->|no / unsupported| SIG[signals: network, TLS,<br/>runtime, behavior, history]
    SIG --> SC{{risk score}}
    SC -->|high trust| PASS
    SC -->|undecided| CH[visible challenge:<br/>checkbox, image grid,<br/>press-and-hold, slider]
    SC -->|low trust| BLK[block or endless challenges]
    CH -->|solved| PASS2[pass this action only]
    CH -->|failed / repeated| BLK
    CR[declared crawler] --> POL{policy: allow,<br/>402 pay-per-crawl,<br/>or labyrinth}
    class PASS,PASS2 ok
    class CH warn
    class BLK bad
    class SC key
    class PAT teal
    class CR,POL violet

The puzzle sits on one branch of the middle path. Attested devices skip it from above; declared crawlers are routed around it by policy; low-trust sessions never get out of it.

From puzzle to score

The first CAPTCHAs asked the user to prove something. The current generation observes instead. Three products dominate:

reCAPTCHA v3. Loads a script on every page, collects signals, and returns a score to the site's backend through a verification API. There is no user interaction at all. The site chooses a threshold per action: allow a comment at 0.5, require email verification for a signup below 0.3. The classic v2 checkbox and image grid are now mostly the fallback shown when a v3 score is low, under the name "reCAPTCHA Enterprise" with adaptive challenges.

Cloudflare Turnstile. Runs in a widget that may be fully invisible, "managed" (shows a checkbox only when needed), or always interactive. The client executes a set of small challenges: proof-of-work, JavaScript environment checks, and a fingerprint, then receives a token the site verifies with Cloudflare. It is also what Cloudflare's own bot management serves as its managed challenge on interstitial pages.

hCaptcha. Similar structure, with a visible image-labeling puzzle as the interactive mode and an invisible scoring mode. It is often chosen for privacy positioning and for its enterprise difficulty tiers.

Other visible formats persist in specific products: the "press and hold" button from HUMAN, slide-to-fit puzzles from GeeTest and Arkose's FunCaptcha, and audio alternatives for accessibility.

Attestation instead of puzzles

Private Access Tokens are the first widely deployed alternative to the score. A supported Apple device asks Apple to attest that it is real hardware running a genuine OS; the attester issues a blinded token; the site's challenge provider accepts it without seeing device data. Google's reCAPTCHA documentation describes PAT as one of its signals, notes that a 401 from a /pat endpoint is a normal part of the flow, and states that devices unable to produce a PAT are not penalized.

Cloudflare Turnstile accepts PATs the same way, with Apple validating the device rather than Cloudflare. Coverage is the limit: strong on Apple platforms, partial on Cloudflare's network, and effectively absent elsewhere, so in 2026 PAT is one lane, not a replacement. For scrapers the implication is that the human population's bar keeps rising while the automated population's does not move.

Proof of work and the crawler economy

The AI crawling surge of 2024 and 2025 produced a different kind of gate. Anubis, an open-source reverse proxy adopted widely by Git forges and free-software projects, requires the browser to find a SHA-256 hash with a number of leading zeros (five by default) before serving the page. The cost is uneven: around two seconds on a current laptop, minutes on an old phone, and a few milliseconds for a scraper that implements the solver natively, which critics measured in 2026.

In practice its user-agent denylist does most of the blocking and the proof of work deters only crawlers that did not bother. Reports in mid 2025 that some AI crawlers had learned to solve it confirm the design limit: proof of work taxes the honest.

Cloudflare went another way. Since July 1, 2025 it blocks known AI crawlers by default on new domains and offers pay-per-crawl, which answers a recognized crawler with HTTP 402 and a price. Its AI Labyrinth serves non-compliant crawlers a maze of generated decoy pages rather than a block.

One report describes a further default change planned for September 2026 for crawlers that combine search, training and agent roles on pages with ads; it is single-sourced and worth checking against Cloudflare's own announcements. The common thread: for automated traffic the "challenge" is becoming a declared identity plus a policy or a price, with the puzzle reserved for anonymous clients.

What the score is made of

The same four layers: network reputation, protocol fingerprint, runtime fingerprint, and behavior. CAPTCHA vendors add one more that general anti-bot vendors have less of: cross-site history. A reCAPTCHA script runs on millions of sites and a Google account cookie, if present, carries a long history.

A browser with years of normal use signed into an account scores high before the page finishes loading. A fresh profile in a datacenter scores low on the same page with the same behavior.

Why the puzzle is getting harder

Image labeling has been automated by vision models for several years, and vendors know it. Their response is not to make images harder for humans; it is to show puzzles only to sessions that already look automated, and then to serve them in sequences (solve three, then two more) and with dynamic difficulty. A session that solves quickly and perfectly every time is itself a signal. The puzzle is a cost imposed on the suspicious, not a test for everyone.

Solving services and their limit

Services exist that accept a puzzle and return an answer, using crowd labor or models, for a fraction of a cent per solve for the easy types. For a scraper, the economics are decisive. If the session scored well, no puzzle appears and no solve is needed. If it scored badly, a solve lets one action through, the score does not improve, and the next action needs another solve.

Costs scale with volume while the underlying problem remains. For low-volume, high-value actions it can be rational. For scraping listings at scale it never is.

There are also legal and terms dimensions: both reCAPTCHA and hCaptcha terms prohibit automated solving, and in some jurisdictions circumventing an access control is a separate offense from any later use of the data.

Demonstration: watch the score, not the puzzle

Register a free reCAPTCHA v3 site key for localhost and put this page on a local server. It shows the score the same browser gets under different conditions, with no puzzle involved.

<script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script>
<button id="go">score me</button><pre id="out"></pre>
<script>
document.getElementById('go').onclick = () => grecaptcha.ready(() =>
  grecaptcha.execute('YOUR_SITE_KEY', { action: 'demo' }).then(async token => {
    const r = await fetch('/verify', { method: 'POST', body: token });
    document.getElementById('out').textContent = await r.text();
  }));
</script>

A verifying endpoint, so the secret never reaches the page:

# server.py — run with: python3 server.py  (expects SECRET in the environment)
import os, json, urllib.request, urllib.parse
from http.server import BaseHTTPRequestHandler, HTTPServer

class H(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers()
        self.wfile.write(open("index.html", "rb").read())
    def do_POST(self):
        token = self.rfile.read(int(self.headers["Content-Length"]))
        body = urllib.parse.urlencode({"secret": os.environ["SECRET"], "response": token}).encode()
        resp = json.load(urllib.request.urlopen("https://www.google.com/recaptcha/api/siteverify", body))
        self.send_response(200); self.end_headers()
        self.wfile.write(json.dumps({"score": resp.get("score"), "action": resp.get("action")}).encode())

HTTPServer(("localhost", 8000), H).serve_forever()

Click the button under each condition and note the score:

Nothing in this experiment bypasses anything; the page is yours and the key is yours. What it shows is that the number the site acts on was decided by the layers below the CAPTCHA, and that a solving service would have had nothing to solve in the top rows and would not have moved the score in the bottom ones.

Frequently asked questions

How does reCAPTCHA v3 work?

reCAPTCHA v3 runs a script on every page, collects signals and returns a score from 0.0 to 1.0 to the site's server through a verification call. There is no puzzle. The site picks a threshold for each action and decides what to do with low scores.

What is the difference between Turnstile and reCAPTCHA?

Both return a token that the site verifies on its server. Turnstile gives a pass or fail rather than a score, runs proof-of-work and environment checks in the browser, and does not use cross-site account history. It is also Cloudflare's managed challenge.

What are Private Access Tokens?

Private Access Tokens let supported Apple devices prove through Apple that they are real hardware, without sharing device data with the site. Both reCAPTCHA and Turnstile accept them, so those visitors can skip the challenge. Devices without them are not penalized.

Are CAPTCHA solving services worth it for scraping?

Rarely. A solve lets one action through but does not raise the session's score, so the next action needs another solve and costs grow with volume. Automated solving also breaks the reCAPTCHA and hCaptcha terms. Fixing the signals that trigger the puzzle works better.