Cloudflare Turnstile solver library (no headless browser required)

Author here. I submitted this a few days ago but seems like it was added to the second chance pool so now it’s on the front page. Anyways, I have received a report from a user that this solver did not work for them with European proxies but did with US proxies… so they may be serving different versions for different regions. I will fix that soon. I’m not at my computer right now but it was working when I tested it a few hours ago (Cloudflare constantly changes things).

I've been using Edge Dev as my daily driver for years, and the last couple updates it's been failing Turnstile off and on. I get this error code on https://debug.challenges.cloudflare.com/ that's not currently throwing because it magically started working again.

But when it's not working, I've realized that roughly 30-50% of the internet is walled off to me in this browser profile because I can't pass the black box of Cloudflare's challenge.

What's truly maddening is that bypasses like this one are definitely ubiquitous and that at-scale actors are doing distillation and spamming social media and doing Dead Internet all over the place, but the end result is that I can't log into Letterboxd or whatever.

I don't know, I'm not even mad at Cloudflare, they're doing their best too. And I use LLMs every day, they're powerful tools, and Pandora's box ain't closing. It just feels like the internet has hit peak saturation of DDoS-by-LLM

For better or worse, it's like `yt-dlp` — constant race against CF, so it's not reliable. It's probably for better.

I made something like this about a year ago. It worked until it didn't. My assessment is that an individual bypass isn't that hard, but doing it at scale is an entirely different and much harder game to play.

It's a hard game to play because they analyze behaviors across their entire network and detect behavioral patterns that are almost impossible to emulate at scale.

"The walls have ears."

Personally I would be careful about poking this bear so publicly. All it does is accelerate escalation and cause those of us who have been subjected to user-agent discrimination and found our own workarounds even more difficulty.

With the rise of AI, this point may be moot, but this is still a war and anything you make public can and will be used against you.

I'm a little surprised that I didn't find any TLS cipher ordering in this project, which I'm sure is something that CF uses as a line of defense.

My Cloudflare solver is command + w. It's 100% reliable in a headful browser and occasionally results in finding an alternative site that doesn't place its priorities (denying bots) over the user's (judicious use of time).

What are the legal implications for bypassing turnstiles?

Just out of curiousity, which model did you use and what did you say to convince it to help? I'm pretty sure Claude would have told you to kick rocks.

Sigh. Once again computers have been shown to do better something than I can, for a task where ostensibly the inverse should hold true.

Also fun tip, if you are ever stuck behind the Anubis PoW proxy, node.crypto is sufficient hardware acceleration to solve it in under a second.

[flagged]

[flagged]

[dead]

Is it that difficult? Use a warm Safari profile on a real Mac. Then Turnstile becomes Apple's problem, ie, solved, because they use PAT.

It’s a good day to have a register of URLs that are Cloudflare gated. FYI my agent says that this is borderline useless and wasn’t needed at all for my purposes.

the actual value comes from having a solution which tracks cloudflare, a full LLM pipeline for pulling the most recent obfuscated code, reversing it and updating the current solver. without it, users aren't going to have confidence in the continuity of the solver to build around it.

that said, most of the people who really need it roll their own in-house. don't think I have seen someone post it to github yet.