Captcha solving service blog | SolveCaptcha
How to find Google reCAPTCHA site key on any website
How to find Google reCAPTCHA site key
A Google reCAPTCHA site key is a public identifier used to load and configure reCAPTCHA on a web page. Developers may need it when testing a reCAPTCHA integration, debugging browser automation, or creating an authorized data collection workflow with a service such as [SolveCaptcha](/).
Unlike the secret key, the site key must be available in the browser. It can usually be found in HTML attributes, JavaScript configuration, Google reCAPTCHA script URLs, iframe URLs, or network requests.
This guide covers the most reliable ways to find the site key for:
- reCAPTCHA v2 Checkbox;
- Invisible reCAPTCHA v2;
- reCAPTCHA v3;
- reCAPTCHA Enterprise;
- dynamically rendered reCAPTCHA widgets;
- single-page applications.
Use these methods only on websites you own or are authorized to inspect and automate.
## What is a reCAPTCHA site key?
Google reCAPTCHA uses a key pair:
- **Site key:** a public value used by frontend code to load and render reCAPTCHA.
- **Secret key:** a private value used by the website backend to verify a reCAPTCHA response.
A site key may appear in page source code and browser requests. This is expected because the browser needs the key to initialize the widget.
A secret key must never be exposed in:
- HTML;
- frontend JavaScript;
- browser network requests;
- public repositories;
- mobile application bundles.
If a secret key is visible in client-side code, it should be considered compromised and replaced.
## Quick ways to find a reCAPTCHA site key
The most common places are:
```html
```
```html
```
```javascript
grecaptcha.execute('SITE_KEY', {
action: 'login'
});
```
```text
https://www.google.com/recaptcha/api2/anchor?...&k=SITE_KEY
```
Depending on the implementation, the parameter may be named:
- `data-sitekey`;
- `sitekey`;
- `render`;
- `k`;
- `googlekey` when sending it to SolveCaptcha.
## Method 1: Find data-sitekey in DevTools
For standard reCAPTCHA v2 integrations, the key is frequently stored in a `data-sitekey` attribute.
### Steps
1. Open the page containing reCAPTCHA.
2. Open browser developer tools:
- Windows or Linux: `Ctrl+Shift+I`;
- macOS: `Cmd+Option+I`.
3. Select the **Elements** tab.
4. Press `Ctrl+F` or `Cmd+F`.
5. Search for:
```text
data-sitekey
```
A typical result looks like this:
```html
```
The value assigned to `data-sitekey` is the reCAPTCHA site key:
```text
6LcExampleSiteKey123456789
```
You can also search for:
```text
g-recaptcha
```
This often leads to the element that initializes a visible reCAPTCHA v2 widget.
## Method 2: Use the browser console
The following command returns every `data-sitekey` value found in the current document:
```javascript
[
...document.querySelectorAll('[data-sitekey]')
].map((element) => element.getAttribute('data-sitekey'));
```
To remove duplicate values:
```javascript
[
...new Set(
[...document.querySelectorAll('[data-sitekey]')]
.map((element) => element.getAttribute('data-sitekey'))
.filter(Boolean)
)
];
```
Example result:
```javascript
[
"6LcExampleSiteKey123456789"
]
```
If the command returns an empty array, the site may initialize reCAPTCHA through JavaScript, an iframe, a shadow DOM, or a network request.
## Method 3: Search the page source
The Elements panel shows the current DOM after JavaScript modifications. The original page source can sometimes contain additional configuration.
Open the source using:
```text
view-source:https://example.com/page
```
Or right-click the page and select **View page source**.
Search for:
```text
data-sitekey
```
```text
grecaptcha.render
```
```text
grecaptcha.execute
```
```text
recaptcha/api.js
```
```text
recaptcha/enterprise.js
```
```text
sitekey
```
```text
render=
```
The site key may be stored directly in a script:
```javascript
const recaptchaSiteKey =
'6LcExampleSiteKey123456789';
```
Or inside a configuration object:
```javascript
window.appConfig = {
recaptcha: {
sitekey: '6LcExampleSiteKey123456789'
}
};
```
The variable name is not standardized. Possible names include:
- `sitekey`;
- `siteKey`;
- `recaptchaKey`;
- `recaptchaSiteKey`;
- `googleRecaptchaKey`;
- `publicKey`.
## Method 4: Find the site key in an iframe URL
Visible reCAPTCHA v2 widgets are often loaded inside an iframe.
Inspect the iframe in the Elements panel and look at its `src` attribute:
```html
```
The site key is stored in the `k` query parameter:
```text
k=6LcExampleSiteKey123456789
```
You can extract it from every matching iframe with this console command:
```javascript
[
...document.querySelectorAll(
'iframe[src*="recaptcha"]'
)
]
.map((iframe) => {
try {
const url = new URL(iframe.src);
return url.searchParams.get('k');
} catch {
return null;
}
})
.filter(Boolean);
```
This method is particularly useful when:
- the original `data-sitekey` element has been removed;
- the widget was rendered programmatically;
- the captcha is inside dynamically generated markup;
- the page contains an Invisible reCAPTCHA integration.
## Method 5: Find a reCAPTCHA v3 site key
reCAPTCHA v3 usually does not display a checkbox or image challenge. It runs in the background and returns a risk score.
The site key is commonly included in the Google API script URL:
```html
```
The value of the `render` parameter is the site key:
```text
6LcExampleV3SiteKey
```
Use this console command to inspect matching script elements:
```javascript
[
...document.querySelectorAll(
'script[src*="recaptcha"]'
)
]
.map((script) => {
try {
const url = new URL(script.src);
const render = url.searchParams.get('render');
if (render && render !== 'explicit') {
return render;
}
return null;
} catch {
return null;
}
})
.filter(Boolean);
```
The key can also appear in a `grecaptcha.execute()` call:
```javascript
grecaptcha.execute(
'6LcExampleV3SiteKey',
{
action: 'login'
}
);
```
In this example:
```text
Site key: 6LcExampleV3SiteKey
Action: login
```
When integrating reCAPTCHA v3 with SolveCaptcha, both values may be required.
A typical API request uses:
```text
method=userrecaptcha
version=v3
googlekey=6LcExampleV3SiteKey
pageurl=https://example.com/login
action=login
json=1
```
## Method 6: Find an Invisible reCAPTCHA v2 key
Invisible reCAPTCHA v2 may be attached to a button rather than displayed as a checkbox.
Example:
```html
```
The site key is still stored in:
```text
data-sitekey
```
Programmatic rendering may look like this:
```javascript
grecaptcha.render('captcha-container', {
sitekey: '6LcExampleInvisibleKey',
size: 'invisible',
callback: submitForm
});
```
Search for:
```text
size: 'invisible'
```
```text
size="invisible"
```
```text
grecaptcha.render
```
```text
data-sitekey
```
The iframe method also works. Inspect the URL and copy the value of the `k` parameter.
## Method 7: Find a reCAPTCHA Enterprise site key
reCAPTCHA Enterprise may load a different JavaScript file:
```html
```
The site key is the value of:
```text
render=SITE_KEY
```
Enterprise implementations may also use:
```javascript
grecaptcha.enterprise.execute(
'SITE_KEY',
{
action: 'login'
}
);
```
Search the page source and loaded scripts for:
```text
recaptcha/enterprise.js
```
```text
grecaptcha.enterprise
```
```text
enterprise.execute
```
```text
render=
```
For a SolveCaptcha reCAPTCHA Enterprise task, the request normally includes:
```text
method=userrecaptcha
googlekey=SITE_KEY
pageurl=https://example.com/page
enterprise=1
json=1
```
For reCAPTCHA v3 Enterprise, it may also require:
```text
version=v3
action=ACTION_NAME
min_score=0.3
```
The site key alone may not be enough. Check whether the page also supplies:
- an action name;
- a `data-s` value;
- a custom reCAPTCHA domain;
- cookies;
- a specific User-Agent.
## Method 8: Use the Network panel
The Network panel is one of the most reliable methods for dynamically loaded captcha widgets.
### Steps
1. Open DevTools.
2. Select the **Network** tab.
3. Enable **Preserve log** if the page redirects.
4. Reload the page.
5. Filter requests using:
```text
recaptcha
```
Look for requests containing names such as:
```text
api.js
```
```text
enterprise.js
```
```text
anchor
```
```text
reload
```
```text
bframe
```
Open a request and inspect its URL or query parameters.
For reCAPTCHA v2, an anchor request may contain:
```text
https://www.google.com/recaptcha/api2/anchor?k=SITE_KEY&...
```
Copy the value of:
```text
k
```
For reCAPTCHA v3, the initial script request may contain:
```text
https://www.google.com/recaptcha/api.js?render=SITE_KEY
```
Copy the value of:
```text
render
```
For Enterprise:
```text
https://www.google.com/recaptcha/enterprise.js?render=SITE_KEY
```
## Method 9: Search loaded JavaScript files
Some applications keep the site key inside compiled JavaScript bundles.
In DevTools:
1. Open the **Sources** tab.
2. Press:
- `Ctrl+Shift+F` on Windows or Linux;
- `Cmd+Option+F` on macOS.
3. Search all loaded files for:
```text
data-sitekey
```
```text
sitekey
```
```text
grecaptcha.execute
```
```text
grecaptcha.render
```
```text
api.js?render=
```
```text
enterprise.js?render=
```
Minified bundles may contain code such as:
```javascript
grecaptcha.execute("6LcExampleSiteKey", {
action: "checkout"
});
```
Use the **Pretty print** button in DevTools to format minified JavaScript before examining it.
## Universal JavaScript detector
The following console script checks the most common site key locations:
```javascript
(() => {
const results = [];
const addResult = (key, source) => {
if (!key || key === 'explicit') {
return;
}
results.push({
key,
source
});
};
document
.querySelectorAll('[data-sitekey]')
.forEach((element) => {
addResult(
element.getAttribute('data-sitekey'),
'data-sitekey attribute'
);
});
document
.querySelectorAll('script[src*="recaptcha"]')
.forEach((script) => {
try {
const url = new URL(script.src);
addResult(
url.searchParams.get('render'),
'reCAPTCHA script render parameter'
);
} catch {
// Ignore invalid URLs.
}
});
document
.querySelectorAll('iframe[src*="recaptcha"]')
.forEach((iframe) => {
try {
const url = new URL(iframe.src);
addResult(
url.searchParams.get('k'),
'reCAPTCHA iframe k parameter'
);
} catch {
// Ignore invalid URLs.
}
});
const source = document.documentElement.innerHTML;
const patterns = [
{
name: 'grecaptcha.execute call',
regex:
/grecaptcha(?:\.enterprise)?\.execute\s*\(\s*['"]([^'"]+)['"]/g
},
{
name: 'sitekey property',
regex:
/(?:sitekey|siteKey|recaptchaSiteKey)\s*[:=]\s*['"]([^'"]+)['"]/g
},
{
name: 'render URL parameter',
regex:
/recaptcha\/(?:api|enterprise)\.js\?[^"'<>]*render=([^&"'<>]+)/g
}
];
for (const pattern of patterns) {
for (const match of source.matchAll(pattern.regex)) {
addResult(
decodeURIComponent(match[1]),
pattern.name
);
}
}
const uniqueResults = [
...new Map(
results.map((item) => [
`${item.key}:${item.source}`,
item
])
).values()
];
console.table(uniqueResults);
return uniqueResults;
})();
```
The script checks:
- `data-sitekey` attributes;
- reCAPTCHA script URLs;
- iframe `k` parameters;
- `grecaptcha.execute()` calls;
- common JavaScript configuration properties.
It cannot inspect code hidden inside cross-origin iframes or JavaScript that has not yet loaded.
## How to find the key on a single-page application
React, Vue, Angular, and other single-page applications may create reCAPTCHA only after a specific action.
The key may not exist immediately after the page loads.
Try the following:
1. Open DevTools before performing the action.
2. Enable **Preserve log** in the Network panel.
3. Open the form that triggers reCAPTCHA.
4. Click the login, register, submit, or checkout button.
5. Filter network requests by `recaptcha`.
6. Inspect newly created scripts and iframes.
7. Search loaded JavaScript bundles.
You may need to trigger the captcha before its parameters become visible.
Common trigger actions include:
- opening a login modal;
- submitting a form;
- requesting a password reset;
- adding a comment;
- starting checkout;
- sending multiple requests;
- receiving a low risk score.
## What if the captcha is inside an iframe?
The browser’s same-origin policy may prevent JavaScript on the main page from reading content inside a Google iframe.
You usually do not need to access the iframe document itself.
Instead, inspect the iframe element on the parent page:
```javascript
[
...document.querySelectorAll('iframe')
]
.map((iframe) => iframe.src)
.filter((src) => src.includes('recaptcha'));
```
Then inspect the URL and extract:
```text
k=SITE_KEY
```
## What if there are multiple site keys?
A page can contain more than one reCAPTCHA integration.
For example:
- one key for login;
- another for registration;
- a separate Enterprise key;
- different keys for v2 and v3;
- separate widgets loaded by third-party components.
Do not automatically use the first key you find.
Match the key to:
- the correct form;
- the correct page URL;
- the relevant iframe;
- the request triggered by the target action;
- the corresponding `action` value for reCAPTCHA v3.
Use the Network panel to determine which key is used when the required action occurs.
## How SolveCaptcha uses the site key
SolveCaptcha expects the public reCAPTCHA site key in the `googlekey` parameter.
Basic reCAPTCHA v2 request:
```text
https://api.solvecaptcha.com/in.php
```
POST parameters:
```text
key=YOUR_API_KEY
method=userrecaptcha
googlekey=SITE_KEY
pageurl=https://example.com/page
json=1
```
A successful response contains a task ID:
```json
{
"status": 1,
"request": "2122988149"
}
```
The result is retrieved from:
```text
https://api.solvecaptcha.com/res.php
```
Using:
```text
key=YOUR_API_KEY
action=get
id=2122988149
json=1
```
For reCAPTCHA v3, include the version and action:
```text
key=YOUR_API_KEY
method=userrecaptcha
version=v3
googlekey=SITE_KEY
pageurl=https://example.com/login
action=login
min_score=0.3
json=1
```
For Enterprise, add:
```text
enterprise=1
```
The `pageurl` must be the complete URL of the page where the reCAPTCHA is initialized.
## How to use the SolveCaptcha browser extension
The [SolveCaptcha browser extension](/captcha-solver-extension) can automatically detect and process supported captcha types in Chrome.
To use it:
1. Install the extension from the [Chrome Web Store](https://chromewebstore.google.com/detail/captcha-solver-auto-recog/nghbiefcnamlpkjagnhoknkklkfiganp).
2. Create a SolveCaptcha account.
3. Copy your API key from the account settings.
4. Enter the API key in the extension.
5. Open the page containing reCAPTCHA.
6. Allow the extension to detect the captcha.
For manual API integration, DevTools remains the most reliable way to confirm the exact site key, reCAPTCHA version, action, and page URL.
## Common mistakes
### Copying the secret key
The browser exposes the public site key, not the private secret key.
A normal frontend inspection should never reveal the secret key.
### Using the wrong key
A page may contain multiple integrations. Make sure the selected key belongs to the form or action being automated.
### Copying an action instead of the site key
In this code:
```javascript
grecaptcha.execute('SITE_KEY', {
action: 'login'
});
```
The values are:
```text
Site key: SITE_KEY
Action: login
```
Both may be required for reCAPTCHA v3, but they are not interchangeable.
### Using render=explicit as a site key
This URL does not contain a site key:
```text
https://www.google.com/recaptcha/api.js?render=explicit
```
The word `explicit` tells Google that the widget will be rendered programmatically.
Search the JavaScript code for:
```text
grecaptcha.render
```
or inspect the generated iframe URL.
### Ignoring the page URL
A site key may be restricted to specific domains. SolveCaptcha requests should use the complete page URL where the captcha is loaded.
### Looking only at the original HTML
Modern applications may load the site key after an API request or user interaction. Check the live DOM, Network panel, and loaded JavaScript files.
## Frequently asked questions
### Is a reCAPTCHA site key private?
No. The site key is public and must be available to frontend code.
The secret key is private and must remain on the website’s server.
### Where is a reCAPTCHA v2 site key stored?
It is commonly stored in:
- a `data-sitekey` attribute;
- a `grecaptcha.render()` configuration object;
- the `k` parameter of a reCAPTCHA iframe URL.
### Where is a reCAPTCHA v3 site key stored?
It is commonly found in:
- the `render` parameter of `api.js`;
- the first argument of `grecaptcha.execute()`;
- a JavaScript configuration object;
- a reCAPTCHA network request.
### What does the k parameter mean?
In a reCAPTCHA iframe URL, the `k` parameter normally contains the public site key.
Example:
```text
https://www.google.com/recaptcha/api2/anchor?k=SITE_KEY
```
### Can a website hide its reCAPTCHA site key?
Not completely. The browser needs the public key to initialize reCAPTCHA, so it must eventually appear in frontend code or a browser request.
### Is the site key enough for reCAPTCHA v3?
Not always. You may also need:
- the page URL;
- the action name;
- the reCAPTCHA version;
- the required score;
- Enterprise mode;
- session-specific parameters.
### Can I find the key without displaying the captcha?
Yes. reCAPTCHA v3 normally runs without a visible challenge. Inspect the API script, JavaScript calls, or Network panel.
## Conclusion
The fastest way to find a Google reCAPTCHA site key is to search the page for:
```text
data-sitekey
```
If it is not present, inspect:
```text
api.js?render=SITE_KEY
```
```text
enterprise.js?render=SITE_KEY
```
```text
grecaptcha.execute('SITE_KEY')
```
```text
iframe URL parameter k=SITE_KEY
```
For dynamically rendered pages, use the Network and Sources panels after triggering the protected action.
Once identified, the site key can be passed to the [SolveCaptcha API](/captcha-solver-api) as the `googlekey` parameter together with the full page URL and any additional reCAPTCHA v3 or Enterprise parameters.