CAPTCHA bypass: what gets you past hCaptcha.

People say "bypass" for three different things: never seeing the challenge, skipping it with a trick, and having something solve it for you. On hCaptcha in 2026 only the last one still works. Below is which of the usual methods still work, and what to use in a browser and in code.

Why hCaptcha can't be skipped

When you pass an hCaptcha challenge, the widget puts a token into the form's hidden h-captcha-response field. When you submit, the site's server sends that token to hCaptcha's siteverify endpoint and only goes ahead if hCaptcha says it is valid. A missing token fails. So does an old one, since tokens last about two minutes and work once. A copied token fails too, because siteverify rejects it the second time with invalid-or-already-seen-response.

So every bypass that works ends with a fresh token for that sitekey, submitted with the form. What changes is who solves the challenge: you by hand, an extension in your browser, or a solving API called from your code.

Fewer challenges first

Before you solve anything, check whether you're seeing more challenges than you should. hCaptcha scores each visit, and a VPN or Tor exit, a browser session with no history, or a burst of fast requests all push the score toward "show a puzzle". Fixing those won't make hCaptcha disappear from a site that challenges everyone. On many other sites it means you see it less often. Why am I getting hCaptcha and hCaptcha keeps appearing go through the causes one by one.

In your browser: a solving extension

If you meet hCaptcha on sites you use by hand, the NoneCap Chrome extension solves the challenge on the page as soon as it opens. It handles image grids, drag puzzles and point-on-image prompts, and it includes free solves every day with no account.

1. Add NoneCap from the Chrome Web Store.
2. Open a page with hCaptcha. When the challenge appears, the extension solves it.
3. Pause it per site, or block sites where it should never run, from its menu.

In code: request a token

A scraper, test suite or AI agent has nobody to click the tiles. Code gets past hCaptcha by asking a solving API for a token. Read the sitekey from the page, send it with the page URL, and put the token you get back in h-captcha-response before you submit:

curl "https://api.nonecap.com/v1/solves?wait=90" \
  -H "Authorization: Bearer $NONECAP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type":    "hcaptcha",
    "sitekey": "f5ab1c2d-7e8f-4a9b-b1c2-d3e4f5a6b7c8",
    "url":     "https://target.example/login"
  }'

The response usually carries the P1_ token; one still solving when the wait ends comes back with a null token you poll (see the API reference). Request the token right before you submit, because it expires in about two minutes. The API reference documents every field, including enterprise sitekeys that need rqdata. Step-by-step guides cover Python, Node.js, Go, Selenium, Playwright and Puppeteer. If your code already calls another solving service, the comparisons show how to switch.

What stopped working

A lot of bypass advice online is out of date. The accessibility cookie used to skip challenges for registered users, but it now asks for an SMS check, lasts a day, and is often blocked by the browser; the accessibility alternatives page lists what still works. Buster and other audio solvers were built for reCAPTCHA and do nothing on hCaptcha (what Buster's own docs say). Stealth browser plugins can make challenges rarer for a while, until a detection update lands and they come back.

Use it where you're allowed to

Whether you may solve a captcha automatically depends on the site and on what you do there. Automate your own sites, your tests, and services whose terms allow it. NoneCap's terms rule out fraud, credential stuffing, spam and unauthorised access, and leave it to you to check the terms of the sites you visit.