Is Free AI ReCaptcha Solver by Raptor (Captcha Plugin) safe?
Free AI ReCaptcha Solver by Raptor stores solved reCAPTCHA images and labels and uploads them to captcharaptor.com.
When it solves a reCAPTCHA, the extension records the instruction text and image tiles in local browser storage. Its uploader is enabled by default and sends those stored challenge images and labels to captcharaptor.com during idle, startup, alarm, or manual reporting runs.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Free ReCaptcha Solver uploads your solved CAPTCHA images to captcharaptor.com
By default, the extension uploads every solved reCAPTCHA image, its answer, and a solve ID to captcharaptor.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You solve an image-based reCAPTCHA challenge using the extension's built-in solver.
This runs automatically whenever an image challenge from google.com or recaptcha.net loads.
The extension records the challenge image, a hash, and your selected answer, then uploads them to captcharaptor.com.
Reporting is on by default; no setting has to be enabled for the upload to happen.
Recording the solved challenge for upload
function canvasToBase64Jpeg(canvas) { return canvas.toDataURL("image/jpeg").replace(/data:image\/[a-z]+;base64,/g, "");}const challengeHash = await phash(challengeTileCanvas);const answerBits = answerData.data.map(b => (b ? '1' : '0')).join('').padEnd(16, '0').slice(0, 16);await caplogRPC('caplog::put44', { phash: challengeHash, type: challengeTypeLabel, solvingid, step: stepNumber, selected: answerBits});const challengeImageBase64 = canvasToBase64Jpeg(challengeTileCanvas);await caplogRPC('capimg::put', { phash: challengeHash, img: challengeImageBase64 });Every 1 hour
Uploads run on a 60-minute timer by default, plus on browser startup, when the device goes idle, or when you click Send now in the popup.
HTTP 200, {"ok":true,"saved":[...]} confirming the server persisted the uploaded rows.
- X-Auth-Key
- <redacted>
- Content-Type
- multipart/form-data
- Challenge image(illustrative) base64 JPEG, ~18 KB
A JPEG snapshot of the reCAPTCHA tile or image you were shown.
- Image hash(illustrative) 9f3a1c7e2b44d0aa
A perceptual hash of the challenge image, used to skip duplicate uploads.
- Challenge type(illustrative) crosswalks
The category of the challenge, such as crosswalks or buses.
- Your selected answer(illustrative) 1010000000000000
Which tiles were marked as matching the challenge instructions.
- Solve ID and step(illustrative) 1725900000123-2
An identifier tying every tile of one challenge together, plus its step number.
- Extension version and time(illustrative) 0.2.3000, 1725900012345
The extension build number and the time the row was recorded.
- captcharaptor.com
Receives every solved CAPTCHA image, its hash, challenge type, and your selected answer via the extension's default reporting endpoint.
Where it sends data
Destinations our analysis observed Free AI ReCaptcha Solver by Raptor (Captcha Plugin) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- captcharaptor.com
Free AI ReCaptcha Solver by Raptor (Captcha Plugin) sends data to captcharaptor.com. No other extension we have analysed sends data here.