[/tools/bot-detectors/recaptcha-v2]
← all providersvendor site ↗script2builtins ↗

recaptcha v2 / v3

google's recaptcha loader. v2 ships the i'm-not-a-robot widget, v3 runs entirely in the background and scores every page view. same api.js entry, divergent behaviors.

  • recaptcha api.js

    [ok]

    https://www.google.com/recaptcha/api.js ↗

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-15 04:50 utc
    (6d ago)
    size
    976b
    sha256
    0993676e67d5
    apis touched
    1
    1 raw
    bot tells
    0
    sinks
    0
    0 leaked
    hazards
    0
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (1)

    click a row to drill into every api the script probes in that category.

    • [+] document1 apis · 0 tells · 1 hits
      • [+] document.createElementlow×1
        details + source hits (1)

  • recaptcha probe (gstatic)

    [ok]

    https://www.gstatic.com/recaptcha/releases/Br0hYqpfWeFzYCAXLD4UuCIV/recaptcha__en.js ↗

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-15 04:51 utc
    (6d ago)
    size
    856.2kb
    sha256
    8a975b9c76ea
    apis touched
    493
    493 raw
    bot tells
    22
    sinks
    6
    0 leaked
    hazards
    3
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (16)

    click a row to drill into every api the script probes in that category.

    • [+] window5 apis · 3 tells · 9 hits
      • [+] outerHeightmedium · bot-tell×2
        details + source hits (2)
      • [+] outerWidthmedium · bot-tell×2
        details + source hits (2)
      • [+] innerHeightlow×1
        details + source hits (1)
      • [+] innerWidthlow · bot-tell×1
        details + source hits (1)
      • [+] location.hrefinfo×3
        details + source hits (3)
    • [+] document6 apis · 2 tells · 15 hits
      • [+] *.contentWindowhigh · bot-tell×4
        details + source hits (4)
      • [+] *.contentDocumenthigh · bot-tell×2
        details + source hits (2)
      • [+] document.visibilityStatelow×3
        details + source hits (3)
      • [+] document.hiddenlow×1
        details + source hits (1)
      • [+] document.bodyinfo×4
        details + source hits (4)
      • [+] document.documentElementinfo×1
        details + source hits (1)
    • [+] timing8 apis · 1 tells · 174 hits
      • [+] performance.nowmedium×7
        details + source hits (7)
      • [+] *.getTimezoneOffsetmedium · bot-tell×3
        details + source hits (3)
      • [+] performance.getEntriesByTypelow×1
        details + source hits (1)
      • [+] performance.timeOriginlow×1
        details + source hits (1)
      • [+] performance.timeOriginlow×1
        details + source hits (1)
      • [+] Dateinfo×115
        details + source hits (115)
      • [+] Date.nowinfo×39
        details + source hits (39)
      • [+] *.getFullYearinfo×7
        details + source hits (7)
    • [+] css3 apis · 1 tells · 25 hits
      • [+] *.getComputedStylehigh · bot-tell×2
        details + source hits (2)
      • [+] *.blockSizemedium×22
        details + source hits (22)
      • [+] *.getPropertyValuelow×1
        details + source hits (1)
    • [+] navigator3 apis · 1 tells · 5 hits
      • [+] *.getHighEntropyValueshigh · bot-tell×2
        details + source hits (2)
      • [+] navigator.deviceMemorymedium×1
        details + source hits (1)
      • [+] navigator.userAgentlow×2
        details + source hits (2)
    • [+] media2 apis · 1 tells · 3 hits
      • [+] *.enumerateDeviceshigh · bot-tell×1
        details + source hits (1)
      • [+] crypto.subtleinfo×2
        details + source hits (2)
    • [+] workers2 apis · 1 tells · 2 hits
      • [+] *.registermedium×1
        details + source hits (1)
      • [+] Workermedium · bot-tell×1
        details + source hits (1)
    • [+] headless-tells1 apis · 1 tells · 2 hits
      • [+] globalmedium · bot-tell×2
        details + source hits (2)
    • [+] introspection12 apis · 0 tells · 187 hits
      • [+] Object.setPrototypeOfmedium×7
        details + source hits (7)
      • [+] *.__proto__medium×3
        details + source hits (3)
      • [+] Object.definePropertymedium×3
        details + source hits (3)
      • [+] Symbol.hasInstancemedium×2
        details + source hits (2)
      • [+] Object.getOwnPropertyNamesmedium×1
        details + source hits (1)
      • [+] *.toStringlow×121
        details + source hits (121)
      • [+] *.constructorlow×24
        details + source hits (24)
      • [+] *.hasOwnPropertylow×5
        details + source hits (5)
      • [+] Object.createlow×2
        details + source hits (2)
      • [+] Symbol.iteratorinfo×15
        details + source hits (15)
      • [+] Symbol.asyncIteratorinfo×3
        details + source hits (3)
      • [+] Symbol.toPrimitiveinfo×1
        details + source hits (1)
    • [+] canvas7 apis · 0 tells · 21 hits
      • [+] *.fillinfo×7
        details + source hits (7)
      • [+] *.beginPathinfo×4
        details + source hits (4)
      • [+] *.lineToinfo×3
        details + source hits (3)
      • [+] *.strokeinfo×3
        details + source hits (3)
      • [+] *.moveToinfo×2
        details + source hits (2)
      • [+] *.arcinfo×1
        details + source hits (1)
      • [+] *.fillRectinfo×1
        details + source hits (1)
    • [+] math4 apis · 0 tells · 4 hits
      • [+] Math.logmedium×1
        details + source hits (1)
      • [+] Math.log10medium×1
        details + source hits (1)
      • [+] Math.log2medium×1
        details + source hits (1)
      • [+] Math.powmedium×1
        details + source hits (1)
    • [+] screen4 apis · 0 tells · 6 hits
      • [+] screen.availHeightlow×2
        details + source hits (2)
      • [+] screen.availWidthlow×2
        details + source hits (2)
      • [+] screen.heightlow×1
        details + source hits (1)
      • [+] screen.widthlow×1
        details + source hits (1)
    • [+] dom-layout4 apis · 0 tells · 5 hits
      • [+] *.getBoundingClientRectmedium×2
        details + source hits (2)
      • [+] *.observeinfo×1
        details + source hits (1)
      • [+] MutationObserverinfo×1
        details + source hits (1)
      • [+] PerformanceObserverinfo×1
        details + source hits (1)
    • [+] events3 apis · 0 tells · 16 hits
      • [+] *.timeStamplow×3
        details + source hits (3)
      • [+] *.dispatchEventlow×1
        details + source hits (1)
      • [+] *.addEventListenerinfo×12
        details + source hits (12)
    • [+] fonts1 apis · 0 tells · 4 hits
      • [+] *.loadlow×4
        details + source hits (4)
    • [+] storage1 apis · 0 tells · 15 hits
      • [+] *.keyslow×15
        details + source hits (15)

    bot-detection tells (11)

    strong indicators of bot-detection intent. drill into the categories section below to inspect description, evasion notes, and source snippets for any tell.

    • *.contentWindow ×4
    • *.getComputedStyle ×2
    • *.contentDocument ×2
    • *.getHighEntropyValues ×2
    • *.enumerateDevices ×1
    • *.getTimezoneOffset ×3
    • global ×2
    • outerHeight ×2
    • outerWidth ×2
    • Worker ×1
    • innerWidth ×1

    network sinks (6)

    every place the script could ship data off the page. expand a row to see headers and the traced payload entries.

    • [+] workerGET L[28](1,Q)no leaks

      url source · L[28](1,Q)

      location · L557:371

      new Worker(L[28](1,Q),void 0)
    • [+] image-srcGET G.Fno leaks

      url source · G.F

      location · L593:65

      (new Image).src=G.F
    • [+] fetchGET Gno leaks

      url source · G

      location · L803:238

      fetch(G,{signal:X.signal})
    • [+] fetchGET new Request(this.j,Q)no leaks

      url source · new Request(this.j,Q)

      location · L1162:0

      ((Q={headers:(this.g=!0,this).h,method:this.F,credentials:this.J,cache:void 0,signal:this.U.signal},Y&&(Q[Nb()]=Y),this.M)||hF).fetch(new Request(this.j,Q))
    • [+] fetchGET Y.urlno leaks

      url source · Y.url

      location · L1211:185

      fetch(Y.url,E)
    • [+] fetchGET Y.XW.toString()no leaks

      url source · Y.XW.toString()

      location · L1583:266

      fetch(Y.XW.toString(),l)

    dynamic-execution hazards (3)

    anywhere the script puts code beyond static reach. eval, function, document.write, dynamic import. these are the holes script2builtins-runtime would fill.

    • evalL304:61

      `eval` runs arbitrary source at runtime. content is invisible to static analysis.

      eval(c+X+Q)
    • evalL811:218

      `eval` runs arbitrary source at runtime. content is invisible to static analysis.

      l.eval((X=G,X))
    • evalL811:239

      `eval` runs arbitrary source at runtime. content is invisible to static analysis.

      l.eval(X.toString())