hCaptcha
captcha · Intuition Machines · private
Invisible hCaptcha silently passes a properly stealthed real browser — the image challenge only appears for clients it already distrusts. Same weakness as Turnstile: stealth beats it, so a solver is only needed once distrusted.
Marketing claims
No claim captured yet.
Claim archaeology — what has been marketed, and when
Monthly Wayback snapshots of the 1 page listed below, read back to 2019. A number reaches this timeline only after the sentence around it was read and judged to be hCaptcha describing its own product. Those judgements were made by an AI model (claude-opus-5) and have not yet been checked by a person. Every one is published with the quote it was made from and the reason it was made, so you can check it against the archived page yourself. Numbers that turned out to be customer case studies, uptime SLAs or traffic-composition stats are listed further down — recorded, not published. Nothing is inferred between two dated snapshots.
No claim we could publish as hCaptcha describing its own product has been found in any of the 90 months we were able to read on the pages we track, out of 92 probed between 2019-01 and 2026-08. That is a statement about these pages only — see the list below.
No publishable claim was found on these pages for: detection accuracy, coverage, false-positive rate, decision latency. Numbers we found and held back are listed below.
Our extractor pulled these numbers out of the same snapshots. Each was held back: a number bound to a metric is not automatically the vendor claiming a capability, and treating it as one would score hCaptcha against something it never said.
| Number | Seen | What it actually is | Archived |
|---|---|---|---|
| 99.9% | 2020-11 – 2026-08 48 months | not a vendor claim a vendor claim, but about the share of users handled passively without seeing a challenge, not about detection coverage; our extractor bound it to the wrong metric…-class bot protection Works in every country Complies with GDPR, CCPA, LGPD, PIPL and more Friction-free “No CAPTCHA” & 99.9% passive modes Bot detection and risk scores APT mitigation Control challenges and types shown Control challenge… | link |
| 0ms | 2023-10 – 2026-08 35 months | not a vendor claim a vendor claim about verifying an already-issued token locally with no API call, not the latency of a bot decision; published beside detection-latency figures it would invite a comparison the sentence does not support…with Identity Providers like Okta or Azure AD. Sophisticated RBAC access restrictions available. Instant Verification 0ms latency: verify hCaptcha tokens with no API call. Mobile (iOS and Android) Integration Seamless experience across… | link |
| Page | Era | Months probed | Months read |
|---|---|---|---|
| www.hcaptcha.com/ 2019-01 – 2026-08 | current | 92 | 90 |
“Months read” counts snapshots we actually retrieved and searched.
Sanctioned test surfaces
| Surface | Type | Tier | Basis |
|---|---|---|---|
| Own deployment with test/demo keys (free) | self-deploy-free | B | Own deployment |
A — vendor invites testing · B — our own deployment · C — passive observation
Our test results
| Surface | Technique | Outcome | When |
|---|---|---|---|
| Own deployment with test/demo keys (free) B | — | blocked | 2026-08-13 |
| Own deployment with test/demo keys (free) B | — | passed | 2026-08-13 |
Cited external benchmarks
None cited yet.