# 🖐️ Google's Hand-Wave Captcha, Fully Cracked Open

**URL:** <https://onehack.st/t/googles-hand-wave-captcha-fully-cracked-open/323893>\
**Category:** Tutorials & Methods\
**Tags:** tips-tricks, bypass\
**Created:** [July 15, 2026, 12:16pm UTC](https://onehack.st/t/googles-hand-wave-captcha-fully-cracked-open/323893 "2026-07-15T12:16:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [July 15, 2026, 12:16pm UTC](https://onehack.st/t/googles-hand-wave-captcha-fully-cracked-open/323893/1 "2026-07-15T12:16:27Z")

</div>

## ⋆༺𓆩 What Google’s hand captcha is, why it’s soft, and the complete free toolkit to get past it — one tap each 𓆪༻⋆

* * *

 ![image](https://onehack.st/uploads/default/original/3X/e/b/eb1d1aa888d2262fd49f21462f4168e96176517f.jpeg)

* * *

That “wave at your camera” screen is Google’s **brand-new hand-scan captcha** — it films your hand to prove you’re human.

Here’s what it actually is, why it’s softer than it looks, and the full toolkit built around it. Tap what you want 👇

```auto
[21 dots on your hand] → "human, go ahead"

```

> **🖐️ What the hand screen even is — 21 dots and nothing more**
>
> Google’s newest captcha: [**Hand Gesture Verification**](https://www.helpnetsecurity.com/2026/06/19/google-recaptcha-hand-gesture-verification/). Camera turns on, it maps **21 dots** on your hand (knuckles + fingertips) using [MediaPipe](https://developers.google.com/mediapipe/solutions/vision/hand_landmarker), then says “human.” New in mid-2026, aimed at bulk account-makers, optional for now.  
> Plain writeups: [Tom’s Hardware](https://www.tomshardware.com/tech-industry/googles-camera-based-recaptcha-asks-for-a-hand-scan-to-prove-youre-human) · [Cybernews](https://cybernews.com/privacy/google-captcha-hand-gesture-camera-privacy-fears/) · [gHacks](https://www.ghacks.net/2026/07/06/google-tests-hand-gesture-verification-captcha-that-uses-webcam-biometrics-already-bypassed-with-stock-photos/)

> **🚪 First, the plain way through — no tricks needed**
>
> Before any tooling: it’s a normal Google check, so the boring route often just works.
> 
> - **Allow the camera** , do the gesture in good light, plain background, hand fully in frame.
> - Camera busy/blocked? Close other apps using it, unblock the site’s camera permission, retry.
> - Can’t or won’t use the camera? Hit **“Try another way”** — Google usually offers another verification (phone, another device, tap-yes prompt).

> **📸 The part they'd rather you didn't clock — a flat photo walks through it**
>
> Days after launch: passed with a **stock photo of a hand** held to a **virtual camera** (fake-webcam software that feeds the browser a video instead of your real feed). No live person, no AI.
> 
> - [The bypass, explained](https://android.gadgethacks.com/news/google-recaptcha-hand-gesture-verification-bypassed-by-stock-photo/) · [video](https://youtu.be/Wu_2NKLNTWg) · [disclosure](https://medium.com/@rtf.labs.studio/googles-new-gesture-based-recaptcha-bypassed-with-a-static-image-4b43affe7944)
> - Tool used: [camspoof](https://github.com/hellsontime/camspoof)
> 
> **The core:** it only reads 21 dots. It can’t tell your hand from a picture of one. Feed it the dots → it says yes. Every layer below is that one move, scaled.

> **🖐️ Beyond the photo — print unlimited fake hands from scratch**
>
> Research models that spit out photoreal hands in any pose (bones + skin). The dots can be _made_, not filmed.
> 
> - [MANO](https://github.com/otaheri/MANO) · [NIMBLE](https://github.com/reyuwei/NIMBLE_model) ([site](https://liyuwei.cc/proj/nimble))
> - [HandSynthesis](https://github.com/delaprada/HandSynthesis) · [ObMan render](https://github.com/hassony2/obman_render) · [hand-model topic](https://github.com/topics/hand-model) · [rigged hand](https://sketchfab.com/3d-models/hand-rig-a348cf6087eb4fd98a83b026593823ad)

> **🎭 Same trick, your face, live on the webcam feed**
>
> Real-time face-swap piped straight into any site’s camera box.
> 
> - [DeepFaceLive](https://github.com/iperov/DeepFaceLive) · [Deep-Live-Cam](https://github.com/hacksider/Deep-Live-Cam) · [iRoopDeepFaceCam](https://github.com/iVideoGameBoss/iRoopDeepFaceCam)
> - [faceswap topic](https://github.com/topics/faceswap) · [realtime-face-changer topic](https://github.com/topics/realtime-face-changer)

> **📹 The cable — how fake video gets into any site's camera**
>
> - [camspoof](https://github.com/hellsontime/camspoof) · [v4l2loopback](https://github.com/v4l2loopback) · [obs-v4l2sink](https://github.com/CatxFish/obs-v4l2sink)
> - Setup: [DEV.to](https://dev.to/moniquelive/obs-studio-as-a-virtual-webcam-281d) · [Interfacing Linux](https://interfacinglinux.com/2024/01/09/obs-virtual-webcam-on-linux/)

> **🤖 Browsers that boot up as a brand-new stranger**
>
> Automation that fakes a fresh, normal user each run.
> 
> - [rtfox-browser](https://github.com/rtf-labs-studio/rtfox-browser) (proxy + solver built in) · [Patchright](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright) · [invisible\_playwright](https://github.com/feder-cr/invisible_playwright) · [undetected-chromedriver](https://github.com/ultrafunkamsterdam/undetected-chromedriver)
> - Which actually works → [benchmarks](https://github.com/techinz/browsers-benchmark) · [deep-dives](https://github.com/pim97/anti-detect-browser-tools-tech-comparison) · [2026 test](https://ianlpaterson.com/blog/anti-detect-browser-benchmark-patchright-nodriver-curl-cffi/)
> - Runs ahead in Russian: [Habr](https://habr.com/ru/articles/1030550/) · [vc.ru](https://vc.ru/dev/2971851-rtfox-browser-polnaya-podderzhka-proksi-i-smena-na-letu)

> **🧩 Auto-clear every other captcha standing in the way**
>
> - [hcaptcha-challenger](https://github.com/QIN2DIM/hcaptcha-challenger) (AI solver) · [2captcha](https://github.com/2captcha/2captcha-python) · [solvecaptcha SDKs](https://github.com/solvercaptcha)
> - [awesome-captcha](https://github.com/ZYSzys/awesome-captcha) · [funcaptcha topic](https://repos.ecosyste.ms/hosts/GitHub/topics/funcaptcha) · [solve vs avoid](https://scrapfly.io/blog/posts/best-captcha-solving-api)

> **🎛️ Look human under the hood — ID sticker, handshake, mouse**
>
> Three deeper checks, each with a spoofer + a tester.
> 
> - **Fingerprint** (browser ID): [browserforge](https://github.com/daijro/browserforge) → test on [CreepJS](https://abrahamjuliot.github.io/creepjs) ([how it reads you](https://scrapfly.io/blog/posts/browser-fingerprinting-with-creepjs))
> - **TLS** (connection handshake): [tls tools](https://github.com/topics/tls-fingerprint?o=desc&s=forks) · [curl-impersonate](https://dataresearchtools.com/browser-tls-fingerprint-mimicry-with-curl-impersonate-2026/)
> - **Mouse/behaviour** : [ghost-cursor](https://github.com/Xetera/ghost-cursor) · [Botasaurus](https://www.blog.brightcoding.dev/2026/04/29/botasaurus-build-undefeatable-scrapers-that-bypass-every-detector)
> - China’s parallel scene: [fingerprint-chromium](https://github.com/adryfish/fingerprint-chromium) · [resource hub](https://github.com/zhaotoday/fingerprint-browser)

> **📱 Grab a throwaway number, catch the code, keep moving**
>
> - [fivesim](https://github.com/ErikPelli/fivesim) · [FastRecvSMS](https://github.com/momenbasel/FastRecvSMS) · [5sim API](https://5sim.net/docs)
> - Whole scene: [sms-verification](https://github.com/topics/sms-verification?o=desc&s=stars) · [virtual-phone-number](https://github.com/topics/virtual-phone-number)

> **🗺️ The maps — one page that links every tool at once**
>
> - [TWSC scraping-wiki](https://github.com/TheWebScrapingClub/scraping-wiki/blob/main/index.md) (30+ anti-bot systems + counters)
> - [Awesome-Web-Scraping](https://github.com/luminati-io/Awesome-Web-Scraping/blob/main/python.md) · [2026 list](https://github.com/spinov001-art/awesome-web-scraping-2026) · [curated list](https://github.com/stars/oddmario/lists/web-scraping)

> **💰 The paid version — same move, aimed at bank ID-checks**
>
> - [Group-IB report](https://www.group-ib.com/blog/deepfake-fraud/) · [WEF Cybercrime Atlas 2026 (PDF)](https://reports.weforum.org/docs/WEF_Unmasking_Cybercrime_Strengthening_Digital_Identity_Verification_against_Deepfakes_2026.pdf) (17 face-swap + 8 injection tools tested)
> - [How it works](https://www.duckduckgoose.ai/blog/how-deepfakes-bypass-kyc) · [injection attacks](https://www.deepidv.com/media/articles/deepfake-injection-attacks-bypass-identity-verification-2026)

> **🎟️ What quietly kills captcha for good**
>
> - [Mozilla’s PACT writeup](https://hacks.mozilla.org/2026/06/pact-anonymous-credentials-for-the-web/) · [Privacy Pass](https://blog.cloudflare.com/privacy-pass-standard/)
> - [The Next Web](https://thenextweb.com/news/cloudflare-pact-browser-privacy-bot-traffic-protocol) · [gHacks](https://www.ghacks.net/2026/06/23/cloudflare-and-major-browsers-develop-private-access-control-tokens-to-separate-legitimate-traffic-from-bots/)

> **💡 Where this actually pays off — 5 real spots you'll recognize**
>
> Same one move each time — the check only tests for one thing, so you hand it a clean fake of that thing:
> 
> - **One-per-person giveaways / free trials / referral bonuses** → the “one account per number” wall folds with a throwaway number + fresh browser.
> - **Broken or no webcam** → a “show your face/hand” wall stops being a dead end; feed it a valid frame.
> - **Region-locked signups** → look like a local with a country number + matching IP.
> - **Testing your OWN site** → run these against your defenses and see if they actually hold before real attackers do.
> - **Boring repeat account chores** → automate them without tripping the bot flag.

The camera only counts the dots. It never asks who drew them.