FunCaptcha is the puzzle Arkose Labs shows a session it scores as risky. You turn an animal upright, or you pick the picture that matches a prompt. Arkose sells it to guard logins, signups and APIs, so scripts that automate those flows meet it.
This guide explains what FunCaptcha is today, what Arkose reads before it shows the puzzle, and what a default headless browser shows a site. It ends with what a proxy can and cannot change. On October 23, 2026, we read Arkose's own pages and ran a headless browser on our own machine. We do not cover solving services or ways around the check. Arkose guards account flows on purpose, and the routes that hold up run through the platform.
What FunCaptcha is in 2026
FunCaptcha is the old name, and for a while Arkose called the puzzle MatchKey. On October 23, 2026, the MatchKey address on Arkose's site opened its Arkose Bot Manager page instead.
That page promises "225+ risk signals" and "dynamic challenges that evolve in real time". Arkose sells the product against account takeover, fake signups, SMS toll fraud, API abuse and attacks on two-factor logins. Its Scraping Protection page adds that it "presents challenges based on risk factors".
Searches for solvers fell this year, while searches that name a platform rose:
- funcaptcha
- funcaptcha solver
- roblox captcha
The same pattern runs through smaller terms. "arkose labs bypass" fell from 1,000 searches in May to 10 in August and September. "funcaptcha api" fell from 210 to 10. Meanwhile "arkose labs captcha" reached 1,600 in September and "github captcha" 880.
What Arkose reads before it shows the puzzle
Arkose publishes the fields its Device ID product returns for each session. We read that page on October 23, 2026. Most fields describe the browser and the device. One group describes the address:
| What Arkose reads | Its field or flag | Does a proxy change it? |
|---|---|---|
| The network behind the address | asn / isp, connection_type | Yes, to the exit's network |
| Whether the address is a known relay | is_vpn / is_proxy / is_tor | Arkose does not say how it sets these |
| Requests per address over time | ip.short_term.count, ip.long_term.count | They count against the new address |
| Where the address is | country / region / city | Yes, to the exit's location |
| Time zone against that location | Timezone mismatch detected | No: the time zone belongs to the browser |
| A headless or virtual browser | Headless browser confirmed, Virtual GPU confirmed | No |
| The device itself | arkose_id | No |
Arkose says its device ID "persists through spoofing, VPNs, and browser resets." A new address leaves that ID where it was. The time zone check compares the browser with the address, so a new address on its own can create exactly the mismatch Arkose names.
Arkose scores
the session
Puzzle
when the score is poor
Token
works once
Site's server
checks it with Arkose
What a default headless browser shows a site
Most scripts that meet the puzzle drive a headless browser. So we ran Chrome 155 headless through Puppeteer on October 23, 2026, started the way Puppeteer starts it by default. It loaded a page on our own machine (127.0.0.1), with no proxy, and the page read what any site's script can read.
The browser announced itself twice. navigator.webdriver was true, the flag a browser sets when automation drives it. The user agent said HeadlessChrome, both in the page and in the request header.
The window was odd too. It reported an outer size of 780 by 580 pixels around a page of 800 by 600, smaller outside than inside. The time zone and the languages came from the machine: Europe/Berlin, with German first. Arkose's Device ID page names a headless browser and a virtual GPU among the things it confirms. A proxy changes none of these values.
What a proxy changes
The address is one input among many. A residential exit changes the network behind the address and its location. Requests then count against that new address. Whether Arkose flags an address as a proxy is its own call, and its page does not say how it decides.
Everything else stays where it was: the browser, its automation flags, the device ID and the puzzle itself. A proxy also adds one way to look worse, a time zone that no longer fits the address. For the address side of detection, see how websites detect proxies.
The routes that hold up
- The platform's official API. Many platforms that run Arkose also publish an API with its own limits and terms.
- Our scraper endpoints. For the platforms our scraper APIs cover, one call returns the public data as JSON.
- The account flows themselves. Arkose guards logins and signups on purpose. Read a platform's terms before automating anything behind them.
Free solvers age fast. The open-source library that ranks fourth on Google for "funcaptcha" has carried an open issue titled "OUTDATED" since April 27, 2025. For how the wider solver market works, see our page on solver APIs. Our Arkose page goes deeper into how its scoring works.
Some traffic does belong on a proxy, such as price checks or ad verification. For that, Residential Premium costs $1.49/GB for one GB, falling to $1.00/GB at 1,000 GB+. Our guide to sticky and rotating sessions explains when each fits.
Sources
- Arkose Labs: Arkose Device ID, Arkose Bot Manager (where the old MatchKey address leads) and Arkose Scraping Protection, read October 23, 2026. Arkose's developer docs answered our reader with a bot check, so the token flow comes from CapMonster Cloud's summary.
- CapMonster Cloud's FunCaptcha page, and 2Captcha's and Anti-Captcha's FunCaptcha pages on who solves the puzzles, read October 23, 2026.
- GitHub: the issue list of the noahcoolboy/funcaptcha library, read October 23, 2026.
- Google Ads Keyword Planner, worldwide, English, monthly searches from October 2025 to September 2026, read October 23, 2026.
- Our own run: headless Chrome 155.0.8059.85 through Puppeteer 25.3.0, a temporary profile and a page on 127.0.0.1, with no proxy, October 23, 2026.
