Free tools Windows power users keep installed
One-click scans. No signup required.
For a page you own or are authorized to access, complete the website’s normal two-factor sign-in first, verify that the browser is on the authenticated page, wait for the specific content you need, and then call Puppeteer’s page.screenshot(). Puppeteer’s page.authenticate() is for HTTP authentication credentials; it does not complete a website’s two-factor challenge.
Complete MFA through the site’s normal sign-in flow
Two-factor authentication is part of the website’s access process, not a screenshot option. Sign in with an authorized test account and complete the factor the site requires—such as an authenticator prompt or security key—using its intended flow. The Puppeteer API reference does not document a general MFA-solving API.
For a recurring authorized test, arrange a supported test-account or operator workflow with the site owner. Do not try to defeat the challenge, reuse another person’s session, or bypass access controls.
Verify the authenticated page before capturing
A click or navigation event alone does not prove that sign-in succeeded. Check an application-specific signal, such as the final URL or a uniquely authenticated element. Playwright’s authentication guide demonstrates those verification patterns; it is adjacent browser-automation guidance, not a Puppeteer-specific login recipe.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Once the page is authenticated, wait for the content that belongs in the screenshot. Navigation completion does not necessarily mean that client-rendered or asynchronous content is ready. Use a condition tied to the page and the content you need. Puppeteer locators can wait for conditions such as visibility, enabled state, viewport presence, and a stable bounding box before acting.
Capture the page or a specific element with Puppeteer
Here is a minimal capture after an authorized sign-in and a page-specific readiness check. The login and MFA steps are intentionally represented as a human/operator step because the site controls the challenge and sequence.
import puppeteer from 'puppeteer';
const browser = await puppeteer.launch({ headless: true });
try {
const page = await browser.newPage();
await page.goto('https://example.com/account', { waitUntil: 'domcontentloaded' });
// Complete the site's normal sign-in and MFA flow using an authorized account.
// In an attended workflow, pause here for the operator to finish authentication.
// In a permitted test workflow, use the site's supported test-login process.
await page.waitForSelector('[data-testid="account-dashboard"]', {
visible: true,
});
await page.screenshot({ path: 'account.png', fullPage: true });
} finally {
await browser.close();
}Replace the example URL and selector with values for your application. If a human must complete MFA, run the browser in a mode where the operator can interact with it and pause the test until authentication is confirmed; do not assume headless automation can complete a factor the site requires a person to provide.
Choose the capture area
- Viewport: omit
fullPageto capture the currently visible browser area. - Full page: set
fullPage: trueto capture beyond the viewport. - Clipped region: pass a
cliprectangle in screenshot options when only a defined area is needed. - Element: capture a particular element when a panel, card, or other component is the intended output.
Puppeteer’s Page.screenshot() accepts options including path, type, quality, omitBackground, clip, and fullPage. Select the format and options that match the output you need; full-page capture is not the default.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Capture one element
An element-level screenshot is useful when the entire authenticated page is unnecessary. Find the element after it exists, then call its screenshot method:
const panel = await page.$('[data-testid="account-dashboard"]');
if (!panel) {
throw new Error('Authenticated dashboard element was not found');
}
await panel.screenshot({ path: 'dashboard.png' });Puppeteer scrolls the target element into view if needed. If the element is detached from the document before capture, the screenshot call errors; wait for the element to be stable or locate it again after the page updates.
What Puppeteer authentication APIs do—and do not do
Page.authenticate() is for HTTP authentication
page.authenticate({ username, password }) supplies credentials for HTTP authentication. It is not a website login or MFA API. Puppeteer’s documentation also notes that this method enables request interception behind the scenes, which may affect performance.
Cookies do not necessarily represent a complete login
Puppeteer’s cookie guidance covers retrieving, setting, and deleting cookies. The API reference notes that page-level cookie methods are deprecated in favor of Browser or BrowserContext methods. Do not assume that one cookie is enough to recreate an authenticated session: an application may also rely on other browser storage or passkeys.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect reused authenticated state
Authenticated browser state can function like a credential. The official Playwright guide warns that saved state can contain cookies and headers capable of impersonating an account, and recommends keeping the auth directory out of source control. That storage-state format and guidance are specific to Playwright; for Puppeteer, use the Browser or BrowserContext capabilities supported by your installed version and confirm which state format it accepts.
- Restrict access to any stored session state and keep it out of repositories.
- Use only state created for an authorized test account.
- Delete or rotate the state when it is no longer needed.
The reviewed guidance does not establish a universal retention period or prescribe a particular secrets-management product.
Troubleshoot failed or incomplete screenshots
The screenshot shows the login or MFA screen
The authenticated state was not reached, or the verification signal was too weak. Complete the site’s normal factor flow and wait for a final URL or authenticated-only element before capturing.
The screenshot is blank or missing page content
The capture may have run before client-side content appeared. Wait for a page-specific selector or another meaningful readiness condition instead of relying only on navigation. For interactive steps, Puppeteer locators can wait for visibility and element stability.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An element screenshot throws an error
The target may not exist yet or may have been detached during a page update. Wait for the correct element, then select it immediately before the screenshot; if the application rerenders it, locate it again.
HTTP credentials do not get past the website’s second factor
Page.authenticate() handles HTTP authentication only. Use the website’s normal login and MFA flow for a protected application page.
Capture runs more slowly than expected
Page.authenticate() enables request interception behind the scenes, which can affect performance. If the page does not use HTTP authentication, do not configure that method as a substitute for website sign-in.
Or skip the browser setup
If you already have an authorized way to access the target URL, ScreenshotNeo offers a one-request screenshot API. It does not complete an MFA challenge or grant access to a protected page; authenticate through the site first, then use a URL the service can access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
ScreenshotNeo accepts a URL and returns a screenshot or PDF. Cookie banners are accepted and more than 60 known consent platforms, newsletter popups, and chat widgets are removed before capture; each step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers report the page verdict and billing status. Its MCP server provides screenshot tools for AI agents, and the free plan includes 1,000 shots per month without a card; paid plans start at $5 for 3,000.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/account -o shot.webpSee the ScreenshotNeo API documentation for request options. Sign up for 1,000 free screenshots a month with no card.
Frequently Asked Questions
Can Puppeteer automatically solve a website’s MFA challenge?
The reviewed Puppeteer API reference does not document a general MFA-solving API. Complete the site’s intended authentication flow with an authorized account or operator.
Does Puppeteer’s Page.authenticate() enter my website username and password?
It supplies credentials for HTTP authentication, not a site’s normal login form or its two-factor challenge.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
