What is a CAPTCHA solver farm?

A CAPTCHA solver farm, also called a CAPTCHA farm, is a commercial service that solves CAPTCHA challenges in bulk on behalf of automated clients. A script encountering a challenge forwards it to the service through an API and receives a valid token back moments later. The work is done by paid human workers, by machine-learning solvers, or by a combination of the two.

How solving services work

Two models dominate, and most services use both. The older approach sends challenges to paid workers, who solve them by hand for a small fee per puzzle. The newer one uses machine vision and audio transcription, now capable of handling most common challenges without a person at all. Services such as 2Captcha, Anti-Captcha, CapSolver, and Death By Captcha publish API documentation, per-thousand pricing, and average solve times for each challenge type they support, which in practice means reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile, and ordinary image and text challenges. The challenge was meant to prove a human was present. Often one was, just not the one signing up.

The people doing the solving are, it should be said, ordinary workers performing tedious piecework for very little money. The contempt belongs with the parties buying solves by the million and the operators skimming the margin, not with whoever is clicking the traffic lights.

Why this breaks CAPTCHA as a control

CAPTCHA's premise was economic: make each automated attempt cost more than it is worth. Advertised rates run roughly $0.50 to $1 per thousand for simple image challenges and $1 to $3 per thousand for reCAPTCHA and hCaptcha as of 2026, which puts a single solve somewhere between a twentieth and a third of one cent. An account worth even a dollar to the abuser therefore justifies several hundred solved challenges before the economics turn.

The cost lands almost entirely on the wrong people. Legitimate users get the friction, the misidentified crosswalks, and the accessibility problems, while the automated signups the control was built to stop pass through on a paid API. A gate that inconveniences customers and bills adversaries a rounding error is not doing the job it was installed for.

What to do instead

A solved CAPTCHA only proves that something answered a puzzle at one moment. It says nothing about what the account does next. Dregs scores accounts continuously across their device, identity, and behavioral history, so an account that bought its way through the challenge still has to withstand every check that follows, including links to the batch created beside it.

That evidence feeds the Humanity score because a point-in-time challenge is no longer decisive. Scores update almost instantly as new activity arrives, and each one opens into its observations. A flagged signup can then be judged by what it did, not by whether it clicked the right squares.

Frequently Asked Questions

Q: How much does it cost to solve CAPTCHAs at scale?

A: Advertised rates run roughly $0.50 to $1 per thousand for simple image challenges and $1 to $3 per thousand for reCAPTCHA and hCaptcha as of 2026, and have sat in that band for years. The exact figure matters less than the order of magnitude: a control intended to make automation uneconomic now costs a fraction of a cent per attempt, which is well below the value of a fraudulently obtained account.

Q: Does CAPTCHA still do anything useful?

A: Yes, but not what it was originally sold as. CAPTCHA still eliminates unsophisticated, low-effort automation, and that clears out a meaningful share of junk traffic for very little effort. What it no longer does is stop a motivated adversary, because for anyone willing to spend a few dollars it has become a toll rather than a barrier. Treat it as one filter with a known bypass price, not as the gate.

Q: What works better than CAPTCHA?

A: Signals that persist after the challenge is passed. A solver farm can answer a puzzle, but it cannot make the account behave like a real customer over the following days, and it cannot prevent the account from linking to the hundred others created alongside it. Continuous scoring across device, identity, and behavior catches what a single point-in-time challenge cannot, and it does so without making every legitimate user prove themselves at the door.

Detect automated abuse that gets past CAPTCHA.

Dregs protects your signup flow after CAPTCHA has been solved or bypassed. It scores each account across device, identity, and behavior, exposing automation through what it does next rather than relying on a single challenge.

Schedule a Demo