[/tools/bot-detectors/hcaptcha]
← all providersvendor site ↗script2builtins ↗

hcaptcha

visual + behavioral challenge from intuition machines. ships a loader that boots the widget and gathers a behavioral profile during solve.

  • hcaptcha api.js

    [ok]

    https://js.hcaptcha.com/1/api.js ↗

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-15 04:50 utc
    (6d ago)
    size
    304.6kb
    sha256
    397ce5defedc
    apis touched
    316
    316 raw
    bot tells
    42
    sinks
    3
    0 leaked
    hazards
    0
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (17)

    click a row to drill into every api the script probes in that category.

    • [+] headless-tells3 apis · 3 tells · 19 hits
      • [+] requirehigh · bot-tell×4
        details + source hits (4)
      • [+] globalmedium · bot-tell×12
        details + source hits (12)
      • [+] modulemedium · bot-tell×3
        details + source hits (3)
    • [+] introspection9 apis · 2 tells · 60 hits
      • [+] Function.prototype.toStringhigh · bot-tell×3
        details + source hits (3)
      • [+] Object.definePropertymedium×13
        details + source hits (13)
      • [+] Object.getOwnPropertyDescriptormedium · bot-tell×5
        details + source hits (5)
      • [+] Proxymedium×2
        details + source hits (2)
      • [+] Object.getPrototypeOfmedium×1
        details + source hits (1)
      • [+] *.toStringlow×13
        details + source hits (13)
      • [+] *.hasOwnPropertylow×9
        details + source hits (9)
      • [+] Object.createlow×8
        details + source hits (8)
      • [+] *.constructorlow×6
        details + source hits (6)
    • [+] document8 apis · 2 tells · 43 hits
      • [+] *.contentWindowhigh · bot-tell×5
        details + source hits (5)
      • [+] document.currentScriptmedium · bot-tell×1
        details + source hits (1)
      • [+] document.createElementlow×8
        details + source hits (8)
      • [+] document.createElementNSlow×2
        details + source hits (2)
      • [+] document.referrerlow×2
        details + source hits (2)
      • [+] document.cookielow×1
        details + source hits (1)
      • [+] document.bodyinfo×15
        details + source hits (15)
      • [+] document.documentElementinfo×9
        details + source hits (9)
    • [+] css4 apis · 2 tells · 6 hits
      • [+] *.getComputedStylehigh · bot-tell×1
        details + source hits (1)
      • [+] getComputedStylehigh · bot-tell×1
        details + source hits (1)
      • [+] *.getPropertyValuelow×1
        details + source hits (1)
      • [+] *.matchesinfo×3
        details + source hits (3)
    • [+] navigator4 apis · 2 tells · 9 hits
      • [+] navigator.pluginsmedium · bot-tell×3
        details + source hits (3)
      • [+] navigator.maxTouchPointsmedium · bot-tell×1
        details + source hits (1)
      • [+] navigator.languagelow×4
        details + source hits (4)
      • [+] navigator.userAgentlow×1
        details + source hits (1)
    • [+] window4 apis · 1 tells · 7 hits
      • [+] innerWidthlow · bot-tell×3
        details + source hits (3)
      • [+] devicePixelRatiolow×1
        details + source hits (1)
      • [+] innerHeightlow×1
        details + source hits (1)
      • [+] location.hrefinfo×2
        details + source hits (2)
    • [+] wasm3 apis · 0 tells · 14 hits
      • [+] WebAssembly.Modulemedium×2
        details + source hits (2)
      • [+] WebAssembly.instantiatemedium×1
        details + source hits (1)
      • [+] WebAssemblylow×11
        details + source hits (11)
    • [+] timing3 apis · 0 tells · 77 hits
      • [+] requestAnimationFramelow×1
        details + source hits (1)
      • [+] Dateinfo×52
        details + source hits (52)
      • [+] Date.nowinfo×24
        details + source hits (24)
    • [+] fonts2 apis · 0 tells · 11 hits
      • [+] *.checkmedium×1
        details + source hits (1)
      • [+] *.loadlow×10
        details + source hits (10)
    • [+] media2 apis · 0 tells · 3 hits
      • [+] *.canPlayTypemedium×2
        details + source hits (2)
      • [+] crypto.subtleinfo×1
        details + source hits (1)
    • [+] canvas2 apis · 0 tells · 5 hits
      • [+] *.getContextmedium×1
        details + source hits (1)
      • [+] *.fillinfo×4
        details + source hits (4)
    • [+] events2 apis · 0 tells · 33 hits
      • [+] *.dispatchEventlow×1
        details + source hits (1)
      • [+] *.addEventListenerinfo×32
        details + source hits (32)
    • [+] dom-layout2 apis · 0 tells · 11 hits
      • [+] *.getBoundingClientRectmedium×5
        details + source hits (5)
      • [+] matchMedialow×6
        details + source hits (6)
    • [+] math1 apis · 0 tells · 1 hits
      • [+] Math.sqrtlow×1
        details + source hits (1)
    • [+] audio1 apis · 0 tells · 2 hits
      • [+] *.sampleRatemedium×2
        details + source hits (2)
    • [+] screen1 apis · 0 tells · 2 hits
      • [+] screen.orientationinfo×2
        details + source hits (2)
    • [+] storage1 apis · 0 tells · 13 hits
      • [+] *.keyslow×13
        details + source hits (13)

    bot-detection tells (12)

    strong indicators of bot-detection intent. drill into the categories section below to inspect description, evasion notes, and source snippets for any tell.

    • *.contentWindow ×5
    • require ×4
    • Function.prototype.toString ×3
    • *.getComputedStyle ×1
    • getComputedStyle ×1
    • global ×12
    • Object.getOwnPropertyDescriptor ×5
    • module ×3
    • navigator.plugins ×3
    • document.currentScript ×1
    • navigator.maxTouchPoints ×1
    • innerWidth ×3

    network sinks (3)

    every place the script could ship data off the page. expand a row to see headers and the traced payload entries.

    • [+] fetchGET tno leaks

      url source · t

      location · L4:20283

      G.fetch(t,o)
    • [+] xhrGET i.urlno leaks

      url source · i.url

      location · L4:31241

      payload · shape string

      • <body>: literal null
      null
      V.send(null)
    • [+] fetchGET nno leaks

      url source · n

      location · L4:89370

      fetch(n,o)