If your immigration firm uses software to transfer DS-160 information into the Consular Electronic Application Center (CEAC), you may occasionally find that a workflow that previously worked suddenly starts returning errors or stops creating applications.
The problem may not be your client's DS-160 data.
It may be the way the software interacts with CEAC.
CEAC is a U.S. Department of State system with anti-bot protections, CAPTCHA challenges, session controls and other security measures. The State Department has explicitly described CAPTCHA as a security feature intended to protect CEAC against bots and other vulnerabilities.
When CEAC changes those security controls, third-party automation that depends on programmatic interaction with the website can require updates.
That is one reason immigration firms should understand how their DS-160 autofill software actually works.
How Docketwise DS-160 e-filing works
Docketwise currently offers DS-160 e-filing on its Pro and Advanced plans.
According to Docketwise's own documentation, the user completes a DS-160 Smart Form in Docketwise and then selects:
“e-File this form on ceac.state.gov.”
Docketwise says a new DS-160 application is then created on CEAC using the information provided.
After the process is initiated, the user receives the CEAC Application ID and later visits the official CEAC website to retrieve and continue the application.
That is different from simply filling fields in the CEAC page already open in the user's browser.
The Docketwise documentation describes Docketwise initiating the CEAC application before the user retrieves it on CEAC.
Docketwise does not publicly document enough technical architecture for us to say precisely how every part of that process is implemented.
But the important workflow distinction is that Docketwise is interacting with CEAC to create the application, rather than only filling a CEAC page that the user has already opened themselves.
Why can this type of automation break?
Government websites frequently introduce or change security controls.
CEAC itself uses protections including:
CAPTCHA
Session expiration
Login validation
Request validation
Anti-bot controls
The Department of State has specifically said CEAC's CAPTCHA exists to identify users as human and protect the site from bots and vulnerabilities.
And these protections continue to change.
For example, on September 23, 2026, the Department of State acknowledged a CEAC issue in which some users were receiving blocked errors related to Cloudflare.
When a website adds or modifies security layers like these, an automation workflow that communicates with the site programmatically may suddenly encounter:
Blocked requests
CAPTCHA challenges
Session failures
Cloudflare checks
Changed validation rules
Changed login flows
Different request requirements
That does not necessarily mean the third-party software itself is defective.
It may simply mean CEAC changed the environment the software depends on.
Is automated CEAC access illegal?
It is important to be precise here.
The State Department clearly uses CAPTCHA and other protections specifically to prevent or control bot activity.
However, that does not by itself establish that every form of backend or automated interaction with CEAC is categorically illegal under U.S. law.
The legal analysis can depend on:
How the automation operates
Whether security controls are bypassed
CEAC's applicable terms and policies
Authorization
Applicable federal law
So it is better not to describe a competitor's automation as “illegal” unless you have a specific legal basis and counsel has reviewed that claim.
For immigration firms, the more practical question is:
Does the automation depend on interacting with CEAC in a way that CEAC's anti-bot systems can block?
Fillvisa takes a different approach: a browser bookmarklet
Fillvisa does not create the DS-160 application through a background server.
Instead, Fillvisa uses a bookmarklet.
The workflow is:
Complete the DS-160 information in Fillvisa.
Your information stays in your browser.
Open the official CEAC DS-160 website yourself.
Start or retrieve your CEAC application.
Run the Fillvisa bookmarklet.
The bookmarklet fills the fields directly in the CEAC page already open in your browser.
You review the information.
You continue and submit through CEAC yourself.
Fillvisa's public open-source project describes the DS-160 workflow as browser-based and explicitly identifies the DS-160 autofill tool as a bookmarklet that helps autofill the official CEAC website. The open-source core requires no backend.
Why is a bookmarklet different?
A bookmarklet is JavaScript that executes inside the webpage already open in your browser.
It does not need to pretend to be a separate person browsing CEAC from a remote server.
The user has already:
Opened CEAC
Passed any required CAPTCHA
Started or retrieved the application
Established the browser session
The bookmarklet then helps fill the visible fields on that page.
So instead of:
Third-party server → CEAC
the workflow is:
You → CEAC in your browser → Fillvisa fills the page you are already viewing
You remain in the CEAC session throughout the process.
Does Fillvisa bypass CEAC CAPTCHA?
No.
Fillvisa does not need to solve or bypass CEAC's CAPTCHA for you.
You access the official CEAC site yourself and complete whatever security checks CEAC requires.
The bookmarklet runs only after you are already using the application in your browser.
That makes the workflow fundamentally different from an automation system that must independently access CEAC.
Is Fillvisa immune to CEAC security updates?
Not completely—and no responsible software provider should promise that.
Because Fillvisa runs inside the user's existing CEAC browser session, it is much less dependent on backend access patterns that anti-bot services such as CAPTCHA or Cloudflare are designed to detect.
But CEAC could still change:
Field names
HTML structure
JavaScript behavior
Page navigation
Postback logic
Security restrictions on page scripts
If that happens, the Fillvisa bookmarklet may need to be updated.
The important distinction is that changes aimed specifically at blocking automated server access are less likely to affect Fillvisa's basic architecture because Fillvisa is not independently accessing CEAC from a remote backend.
Why Fillvisa uses semi-automatic autofill
There is an intentional human step in the Fillvisa workflow.
Fillvisa does not attempt to silently submit the DS-160 in the background.
Instead:
Fillvisa prepares → Fillvisa autofills → human reviews → human submits through CEAC
For an immigration form as important as the DS-160, this provides an important review point.
The applicant or preparer can still confirm:
Names
Passport information
Travel history
Employment
Education
Security answers
Other DS-160 responses
before submitting the application to the Department of State.
Fillvisa is also local-first
For the free Fillvisa DS-160, the form data is stored locally in the browser rather than sent to a Fillvisa backend.
Fillvisa's public documentation states that its DS-160 form runs locally and that form answers remain in the user's browser.
That means the workflow is:
Your browser → your CEAC session
rather than:
Your data → third-party server → CEAC
How to autofill a DS-160 with Fillvisa
The process is straightforward.
Step 1: Complete your DS-160 in Fillvisa
Use the browser-based DS-160 form.
Fillvisa automatically saves your progress locally, so you are not working against CEAC's session timeout.
Step 2: Open CEAC
Visit the official Department of State DS-160 website.
Start a new application or retrieve an existing one.
Complete any CAPTCHA or security steps required by CEAC yourself.
Step 3: Run the Fillvisa bookmarklet
Once you're inside the DS-160 application, run the Fillvisa bookmarklet.
It transfers the information from Fillvisa into the corresponding fields in the CEAC page.
Step 4: Review
Review the answers on the official CEAC website.
You remain in control of the application.
Step 5: Submit through CEAC
The final submission still happens through the official Department of State website.
See how it works
Try Fillvisa DS-160 for free
Fillvisa's DS-160 tool is 100% free to use.
It includes:
Browser-based DS-160 preparation
Automatic local saving
No CEAC session timeout while preparing your answers
No account required
Local-first storage
Bookmarklet autofill into the official CEAC application
Human review before submission
Fill out your DS-160 for free with Fillvisa
Frequently asked questions
Why can DS-160 automation suddenly stop working?
CEAC can change its authentication, CAPTCHA, Cloudflare, validation or page behavior.
Automation that depends on programmatically interacting with CEAC may need to be changed whenever those systems change.
Does Docketwise e-file the DS-160 to CEAC?
Docketwise describes its workflow as creating a new DS-160 application on CEAC from information in a Docketwise Smart Form. The user then retrieves the resulting application on the CEAC website using the generated Application ID.
Does Fillvisa automatically submit the DS-160?
No.
Fillvisa autofills the official CEAC form in your own browser.
You review and submit the application yourself through CEAC.
Does Fillvisa use a bot?
Fillvisa's DS-160 workflow uses a browser bookmarklet rather than a remote bot that independently accesses CEAC.
The bookmarklet executes on the CEAC webpage that the user has already opened.
Does Fillvisa bypass CAPTCHA?
No.
The user accesses CEAC and completes CEAC's security checks normally.
The bookmarklet is used after the user is inside the application.
Will CEAC security changes ever break Fillvisa?
They can.
Fillvisa is less exposed to changes specifically targeting remote automated access because it operates inside the user's existing browser session.
However, changes to CEAC's HTML, form fields, JavaScript or page behavior can still require updates to the bookmarklet.
Is using a bookmarklet legal?
Fillvisa's architecture does not bypass CAPTCHA or automatically submit the DS-160 on the user's behalf; the user accesses CEAC, reviews the form and submits it themselves.
However, statements such as “100% legal under all circumstances” are legal conclusions. Organizations with specific compliance concerns should review the relevant government terms and consult counsel.
Fillvisa provides form-preparation software and does not provide legal advice. Applicants and immigration professionals remain responsible for reviewing DS-160 information and submitting the application through the official Department of State CEAC website.