cfsolve: Cloudflare Turnstile solver in Rust
Original: Cloudflare Turnstile solver library (no headless browser required)
Why This Matters
Bot-mitigation tools losing ground to lightweight, request-based solvers matters for web security.
Developer chris124567 released cfsolve, a Rust library that solves Cloudflare Turnstile widgets and challenge pages without a headless browser, returning tokens or cf_clearance cookies via direct HTTP requests.
cfsolve is an open-source Rust library and CLI tool that bypasses Cloudflare's Turnstile CAPTCHA system and challenge pages through full protocol reverse engineering — no headless browser needed. It returns a Turnstile token for widgets or a cf_clearance cookie for full challenge pages.
The tool works by impersonating specific browsers via JSON profile files. One profile ships with the repo: Safari on iPhone (iOS 26). Each profile bundles pre-recorded responses to Cloudflare's browser fingerprinting checks. Developers can generate new profiles by routing a real browser through cfsolve's included capture-proxy, which decodes and records the payloads sent to Cloudflare. Currently only Safari and Chromium profile types are supported.
For Turnstile widgets, inputs are the page URL and sitekey; HTML is optional. Challenge pages require either a direct fetch or raw HTML. The project has 335 stars and 36 forks on GitHub within a short window, signaling significant interest from the scraping and automation community. It is MIT-licensed and written in Rust, requiring CMake and a C/C++ compiler to build.