Solving Cloudflare Turnstile with Playwright

Cloudflare Turnstile replaced the traditional CAPTCHA checkbox with an invisible challenge. It runs JavaScript fingerprints and browser attestation in the background. When automation is detected, Turnstile blocks the request. DeathByCaptcha solves Turnstile challenges automatically.

How Turnstile Works

1. Cloudflare loads a Turnstile widget on the page.
2. The widget collects browser fingerprints (canvas, WebGL, fonts).
3. It generates a cf-turnstile-response token.
4. If the token is valid, the form submits. If not, a challenge appears.

Detecting Turnstile in Playwright

# Check for Turnstile widget
turnstile_frame = page.query_selector("iframe[src*=challenges.cloudflare.com]")
if turnstile_frame:
    print("Turnstile detected")

Solving with DeathByCaptcha

Turnstile uses type=6 in the DeathByCaptcha API:

import json
from playwright.sync_api import sync_playwright
import deathbycaptcha

client = deathbycaptcha.SocketClient(username, password)

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True)
    page = browser.new_page()
    page.goto("https://example.com/login")

    sitekey = page.get_attribute("[name=cf-turnstile-response]", "data-sitekey")

    result = client.decode(type=6, token_params=json.dumps({
        "sitekey": sitekey,
        "pageurl": "https://example.com/login"
    }))
    print("Solution:", result["text"])

    page.evaluate("document.querySelector('[name=cf-turnstile-response]').value='%s'" % result["text"])
    page.click("button[type=submit]")

    browser.close()

Key Differences from reCAPTCHA

• Type parameter: Use type=6 for Turnstile, not type=4 (reCAPTCHA v2).
• Token field: Look for cf-turnstile-response instead of g-recaptcha-response.
• Widget detection: Turnstile uses an iframe from challenges.cloudflare.com.
• Invisible by default: Turnstile is always invisible. No checkbox to click.

Troubleshooting

• Token expired: Turnstile tokens expire in 300 seconds. Solve and inject immediately.
• Detection: Some Turnstile implementations check for headless browsers. Use headed mode if blocked.
• Enterprise: Cloudflare Enterprise Turnstile may require additional attestation tokens.

For API documentation, see the API reference and client libraries.