CAPTCHA: Telling humans from robots

In short: A CAPTCHA is a small task or invisible test meant to tell automated programs from real people, for example at sign-up and in comments.

In more detail: Websites are flooded by bots (programs) with mass sign-ups, spam and password-guessing attempts. A CAPTCHA (“Completely Automated Public Turing test to tell Computers and Humans Apart”) is meant to slow such abuse. It is a kind of reverse Turing test: the computer checks whether a human is answering.

In Depth

Kinds

• Distorted text: reading letters (once widespread, now easily solved by AI).
• Image selection: “Select all traffic lights.”
• Checkbox with behavioural analysis (“I’m not a robot”): mouse and device data decide.
• Invisible methods: reCAPTCHA v3, hCaptcha, Cloudflare Turnstile, which compute a risk score in the background.
• Proof of work: the browser has to compute briefly, which makes mass requests more expensive (for example Altcha, Anubis).
• Honeypot fields: form fields invisible to humans that only bots fill in.

Why they are problematic

Accessibility: image puzzles exclude people with visual or cognitive impairments, audio alternatives are often poor. Privacy: services such as reCAPTCHA transmit data to third parties, which can make consent necessary. Effort: users get annoyed, conversions fall. Security: AI models and click farms solve many tasks better than humans.

Better alternatives

A combination of measures: rate limiting (slowing too many requests from one address), honeypot, verification by email or two-factor, passkeys, checking risk signals in the background and privacy-friendly providers. CAPTCHAs should appear only on suspicion, not for everyone.

Practical notes

Always verify the answer on the server, not only in the browser. Offer an accessible alternative. Document in the privacy policy which service is used. Bots keep evolving; no method stops them permanently.

See also: Rate limiting, Honeypot, Consent under the GDPR, WCAG and colour contrast