cfsolve Solves Cloudflare Turnstile Without a Browser, From One Safari Profile and 123 Stars

A Rust tool called cfsolve that solves Cloudflare Turnstile widgets and challenge pages without launching a browser reached Hacker News on Oct. 30 with 85 points. The repository, published by the GitHub user chris124567, was at 123 stars, 18 forks and 6 commits on master when I read it.

It returns a Turnstile token for a widget, or a cf_clearance cookie for a challenge page. It is MIT-licensed. Nothing on the page says who the author is beyond the username, and the page shows no commit or release dates.

How it avoids a browser

cfsolve impersonates a browser described by a profile file. Each profile points to recorded responses to the challenge's browser checks, stored as JSON. The README says profiles are built by capturing real browser traffic through a capture-proxy.

Cloudflare describes Turnstile as a smart CAPTCHA alternative that runs non-interactive JavaScript challenges, including proof-of-work, proof-of-space, probing for web APIs and checks for browser quirks. A solver that replays recorded answers is betting that those checks are deterministic enough to fake.

What the README admits

The README is plainer about limits than most projects at this size, in the way that Impeccable's README lists its own fragile spots.

Limit	What the README says
Profiles	Only Safari and Chrome(ium) types; one profile ships, Safari on iPhone
Making more	"Producing these files requires some manual (or AI) effort"
Cookies	Cloudflare rejects a cf_clearance unless used from the same IP and user agent
Breakage	Error::Unsupported covers cases such as a new challenge build

The last row is the one that matters. A solver tied to recorded challenge responses stops working when Cloudflare ships a new build, until someone captures new traffic. The README lists the error; it does not say how often that has happened. No dates on the page means I cannot tell either.

Building also needs the Rust version pinned in rust-toolchain.toml, CMake, a C/C++ compiler, libclang and Git, plus patched dependencies in a vendor/ directory that keep their own licences.

What Cloudflare's own docs constrain

Cloudflare's server-side validation page says "Each token is valid for 300 seconds (5 minutes) after generation" and "Each token can only be validated once." A solver cannot stockpile tokens. It has to run per submission, which is a cost on the solving side that a headless browser also pays.

That is the trade the project argues with. Headless browsers are heavy, and browser-free automation is a live niche: we looked at Lightpanda's 9x speed claim, which comes from a different starting point, a lighter browser rather than none.

What is not known

The README contains no usage or legal disclaimer and does not say what the tool is meant for. A Turnstile solver is useful to testers of their own sites and to people scraping or abusing other people's. The repository does not distinguish.

I have not run cfsolve and nothing here tests whether it works today. Stars are not adoption. The thing to watch is Cloudflare's response: a new challenge build would show how long the single Safari profile lasts.