What is a CAPTCHA Sitekey?

A sitekey (or public key) is a public identifier embedded in website client-side HTML or JavaScript. It tells the CAPTCHA provider (like Cloudflare Turnstile or Google reCAPTCHA) which account and security configuration to apply. Because it is public, automated solvers like 2Captcha require this sitekey to generate valid solution response tokens.

Is it safe to share or extract public sitekeys?

Yes. Sitekeys are designed to be public and are delivered to every visitor browser in HTML source code. They are distinct from private secret keys, which are stored securely on the website's server to verify response tokens.

How do I solve a detected CAPTCHA using Python?

Once the sitekey is extracted, you send the target URL and sitekey to the 2Captcha API. 2Captcha processes the challenge and returns a g-recaptcha-response or cf-turnstile-response token, which you inject into your HTTP form or headless browser context.

Home›Tools›CAPTCHA Detector

⚡ Free Online Diagnostic Tool

Online CAPTCHA Detector & Sitekey Extractor

Scan any website URL in real-time to identify anti-bot protections—including Cloudflare Turnstile, Google reCAPTCHA v2/v3/Enterprise, hCaptcha, GeeTest, and Arkose Labs. Automatically extract public sitekeys and generate ready-to-run 2Captcha solver scripts.

Test Demos:

How the Online CAPTCHA Detector Works

Modern anti-scraping systems rely on client-side JavaScript injection, hidden iframe widgets, and browser fingerprint verification. When you submit a target URL to this diagnostic tool, our backend performs a secure, server-side fetch simulating modern desktop browsers (Chrome 131+ with strict Sec-CH-UA headers).

The engine systematically inspects the DOM tree, script tags, global variables, and CDN endpoints for known fingerprint signatures:

Cloudflare Turnstile: Scans for challenges.cloudflare.com/turnstile/v0/api.js, elements bearing the .cf-turnstile class, and extracts the data-sitekey starting with 0x4.
Google reCAPTCHA v2 / v3: Inspects recaptcha/api.js, recaptcha/enterprise.js, and extracts the 40-character alphanumeric sitekey and configured action parameters.
hCaptcha: Evaluates hcaptcha.com/1/api.js and extracts the 36-character UUID public sitekey.
Arkose Labs (FunCaptcha): Detects Arkose client bundles and extracts data-pkey.
GeeTest v3 / v4: Extracts gt and captcha_id identifiers required for slider and puzzle solvers.

How to Extract a CAPTCHA Sitekey Manually Using Chrome DevTools

If a website renders its CAPTCHA dynamically behind user interaction (such as clicking a "Submit" or "Login" button), you can extract the sitekey directly in your browser:

Open the target webpage in Google Chrome or any Chromium browser.
Right-click on the CAPTCHA widget (e.g. the checkbox or challenge box) and select Inspect.
In the Elements panel, look at the container element. For reCAPTCHA, search for class="g-recaptcha" and look for the attribute data-sitekey="...".
For Cloudflare Turnstile, look for <div class="cf-turnstile" data-sitekey="0x4...">.
For dynamic reCAPTCHA v3, switch to the Sources tab, press Ctrl+F (or Cmd+F), and search for grecaptcha.execute to find the embedded sitekey and action string.

Solving Detected Challenges with the 2Captcha API

Once you have extracted the public sitekey and target URL, solving the challenge requires sending a task to an automated solving farm. Across our 24-provider independent benchmarks, 2Captcha ranks #1 in reliability and cost efficiency:

Why 2Captcha is the Top Recommendation:

Turnstile & reCAPTCHA: $0.50 to $1.40 per 1,000 solved challenges.
Zero Headless Overhead: Send the sitekey via REST API; receive the validated token without loading heavy Chromium browsers.
High Throughput: Over 10,000 threads supported simultaneously with 99.8% resolution rate.
Official SDKs: Ready-made packages for Python (pip install 2captcha-python), Node.js, Go, PHP, and C#.

Get 2Captcha API Key ($0.50 / 1000) →

Frequently Asked Questions

What is the difference between a sitekey and a secret key?

A sitekey is public and embedded on client-facing webpages to render the challenge. A secret key is private and stored only on the website's backend server. The backend uses the secret key to verify the response token with Google or Cloudflare after the client submits it.

Why did the detector not find any CAPTCHA on my URL?

Some websites only trigger anti-bot challenges after suspicious behavior (e.g., repeated rapid logins, high request velocity, or data center IP detection). If the protection is rendered dynamically after submitting a form, inspect the network requests using browser DevTools or inspect the login action handler.

Can I use proxies alongside 2Captcha?

Yes! While standard Turnstile and reCAPTCHA can be solved "proxyless" (where 2Captcha uses its internal pool), challenges like DataDome and enterprise Cloudflare require solving via the exact same residential proxy IP. Explore our partner guide at 2-Proxy.com for high-reputation residential IPs.