Scarnox · Blog

GeeTest captcha explained: how it works and how to solve it

GeeTest is a captcha vendor whose widgets ask a visitor to solve a visual task: drag a puzzle piece into a gap, click a set of icons in a given order, or follow a short slider movement. It is common on e-commerce sites, login pages and app backends in many regions. It is also one of the captcha families that Scarnox does not solve yet. This guide explains how GeeTest works, why automating it is harder than a token-based widget, which approaches people use in general, and where Scarnox support stands today.

What GeeTest does on a page

A GeeTest captcha usually loads in three steps:

The page includes the GeeTest script and creates a widget with a captcha ID. In many integrations that ID is passed as a parameter named gt.
The widget asks the GeeTest server for a fresh challenge. The challenge includes a challenge value and the images or tile positions needed for the puzzle.
When the visitor finishes the task, the widget sends the result back to the site. The site's backend then verifies that result with the captcha vendor before it accepts the form.

The third step matters. A plausible-looking value is not enough, because the server checks a result that is tied to one challenge and expires. This is why a value copied from a different session fails, and why replaying an old result does not work.

With PopularCaptcha, the page needs one token string, and a single request returns that string. GeeTest differs in three ways:

The output is a result of a task, not one string. The site expects several values that belong together, and they must all come from the same challenge.
The challenge is visual and positional. A solver has to find where a puzzle piece fits or which icons match, then produce a movement that looks like a person's.
Checks look at behavior as well as the answer. Speed, path and timing can be inspected. A correct position delivered in a robotic way may still be rejected.

Because of this, GeeTest solving is a multi-step job: fetch the challenge, locate the targets in the image, generate a movement, submit it and read the verdict. Each step can fail, and the challenge expires if you wait too long between steps.

General approaches

People who automate GeeTest pages generally use one of three approaches. None of them is a shortcut, and each has costs:

Drive a real browser. Playwright or Selenium loads the page and your script moves the slider. This works best on a site you control or a test environment you are allowed to use. The browser is real, but the movement still has to look natural.
Image matching. Your code downloads the puzzle background, finds the gap with template matching (for example with OpenCV) and computes the drag distance. This is often the most dependable part of a do-it-yourself setup, and it breaks when the vendor changes the image layout.
Human-in-the-loop or a solving service. A person or a managed service solves the challenge and returns the result. Scarnox plans to offer this option for GeeTest, but it is not live yet.

Whichever you choose, keep the scope honest: automate flows you own, test environments you are allowed to use, or public data you are allowed to collect.

Finding the captcha ID

You do not need code to start. Open DevTools, reload the page and search the Network tab for geetest or gt. The first request that loads the widget usually shows the captcha ID. A small script can record it, which is useful when you want to notice when a page changes its widget:

import re
import requests

html = requests.get("https://example.com/login", timeout=30).text
match = re.search(r"gt['\"]?\s*[:=]\s*['\"]([a-f0-9]{32})['\"]", html)
print("captcha id:", match.group(1) if match else "not found")

The pattern above looks for a 32-character hexadecimal value next to gt. Vendors change their markup, so treat it as a starting point and check the output against the page you are testing.

Where Scarnox support stands

Be clear about this when you plan a project:

Live today: PopularCaptcha, proxyless, and with your own proxy.
Coming soon: GeeTest, reCAPTCHA v2 and v3, Cloudflare Turnstile, AWS WAF and Arkose. Do not build a production flow that depends on a GeeTest solve until it is listed as live.

If your project needs GeeTest now, the practical route is to build the browser and image steps yourself for pages you are allowed to test, and to keep your code ready to switch to an API when support ships. Meanwhile, you can create an account and start with free trial credit, no card needed. That gives you a working PopularCaptcha flow to test with and a place to plug in GeeTest later. For current rates, see current pricing.

Legitimate uses

Testing your own login or checkout flow, where a captcha blocks automated regression tests.
Accessibility checks that confirm a visitor who cannot solve a visual puzzle still has another route to finish a form.
Monitoring a site you have permission to watch, for example checking that a widget still loads after a deploy.

Do not use captcha automation to create fake accounts, to attack a login form or to grab limited stock. Those uses break the rules of most sites and are not something Scarnox supports.