Why hCaptcha gives some browsers a puzzle every time

hCaptcha gives some browsers an image challenge every time because the challenge is its score. There is no "you passed" screen; what you get is the verdict. Trusted: nothing, or one easy round. Risky: a grid, then another grid. A grid on every site means one thing about your visit gets the same low rating each time, and it is usually one of four: blocked cookies, a crowded VPN or proxy exit, a browser that contradicts itself, or too many requests. Solving puzzles changes none of the four.

An hCaptcha image challenge every time is the verdict

Our detection catalogue in Mosaic has a row for this page, id hcaptcha, pointed at accounts.hcaptcha.com/demo and filed under WAFs. It is marked reference, which means the app does not grade it on its own. The pass condition is written as a sentence for a person to judge:

A passive pass or a single easy challenge, not an escalating image grid.

We left it that way on purpose. The page never prints a score, so any number our extractor pulled off it would be one we made up. A third round of tiles is the reading.

1. Blocked cookies

This is the cause privacy-minded people hit first. If an extension or a strict cookie setting blocks hCaptcha's cookies, each visit shows up with no history at all, and an empty history gets the full treatment.

To check it:

• allow cookies for hCaptcha's domain and reload
• or try once in a browser profile with default settings

If the grid disappears, that was it.

How it works: Machines that exist

2. A crowded exit

A VPN server carries many people at once, and some of them run scripts. The address has a bad name before your first request leaves. The shape is a grid on every site from the moment you connect.

Residential proxies get this too. A home line sold through a pool carries other customers' traffic, and two sellers can resell one pool (proxy sellers sharing IPs). Switching the VPN off for one visit, or trying another exit, tells you within a minute whether the address is the problem. If it is, you need a cleaner address (residential IPs flagged as proxies covers what the reputation lists look at).

3. A browser that contradicts itself

Every page can read your User-Agent, platform, timezone, language, screen, GPU and fonts. On a normal laptop those agree, because they come from one real machine. Install a User-Agent switcher and the browser says Windows in the header and macOS in the font list. A contradiction costs more than any odd value on its own (what goes into a browser fingerprint).

The exit is part of the same comparison. A German IP with a clock set to Los Angeles does not add up, even if nothing inside the browser was changed.

4. Rate

A burst of sign-ins, searches or form posts raises the score by itself. So do failed attempts at the challenge. If a site is rate-limiting you, stop and come back later; every retry is one more request against you.

What Mosaic changes, and what it leaves alone

Mosaic is built for people running accounts they are entitled to run, one profile per account. Each profile's timezone, language and location follow its proxy's measured exit, so the clock and the IP agree. Fingerprint values are changed in C++ inside the engine, not by an extension, so every frame reads the same machine. Before each launch Mosaic checks the proxy, and it can score an exit's reputation before you put an account behind it (how to check a proxy before you use it).

A site can set hCaptcha to challenge every visitor. Nothing above turns that off, and nothing should: it is the site's call.

One more habit from running detectors. The catalogue row has settleMs: 20000, so nobody reads the hCaptcha demo until twenty seconds after it loads; a reading taken earlier describes a page that has not decided yet (a bot score that read 0 before anything had been measured is that mistake on another detector).