How CAPTCHA works, and why bots now beat it

The original idea

CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart". Researchers proposed it in 2003: set a task that people solve easily but computers can't, and anyone who solves it is probably human [1]. Early CAPTCHAs asked you to type distorted letters.

Google bought reCAPTCHA in 2009 and used the answers as free labelling work: first to read words from scanned books, then house numbers and objects from Street View images [2]. That is why the pictures are so often crosswalks, buses and fire hydrants.

The main types you meet today

• Distorted text: type the letters you see. The oldest type, and the one bots solve best.
• Image selection (reCAPTCHA v2's grids, hCaptcha): "select all images with bicycles".
• The "I'm not a robot" checkbox (reCAPTCHA v2): you tick a box, and a background risk check decides whether to let you through or show you images.
• Invisible scoring (reCAPTCHA v3): no task at all. The page scores each visitor and the website decides what to do with low scores.
• Sliders and puzzles: drag a piece into place, or rotate an image upright.

When researchers inspected 200 of the world's most popular websites in 2023, 120 of them used a CAPTCHA somewhere, and 68 used Google's reCAPTCHA. Across 15.2 million websites known to use a CAPTCHA, reCAPTCHA accounted for 97.3% [1].

What the "I’m not a robot" box actually checks

Ticking the box looks trivial, but the tick itself is not the test. Research into reCAPTCHA's risk analysis found it relies mainly on Google's tracking cookies, together with your browsing history and details of your browser, such as its rendering, screen size and settings [2][3]. If Google recognises you as a normal, active user, you pass. If not, you get image challenges.

That has three consequences for a business:

1. Privacy: your visitors' data goes to Google, which you need to explain in your privacy policy.
2. Speed: in one measurement, adding reCAPTCHA added about 408 KB to a page's first load [2].
3. Unfairness: people with privacy settings, cleared cookies or unfamiliar devices get more puzzles, through no fault of their own.

Why bots now beat it

The whole idea depends on computers being worse than people at the task. That stopped being true:

• Text: by 2014, automated tools read distorted text with over 99% accuracy [1].
• Images: published attacks solve reCAPTCHA image grids with 85% accuracy and hCaptcha with 98%. People managed 71–81% [1].
• The checkbox: researchers showed that "trusted" cookies could be created automatically, and then passed the checkbox with 100% accuracy in about 1.4 seconds, tens of thousands of times a day from one address [3][2].
• Audio: the audio option, meant for people who can't see images, was defeated with off-the-shelf speech recognition [2].
• People for hire: when software fails, the puzzle is forwarded to workers paid a fraction of a cent to solve it; researchers found solutions sold for around one dollar per thousand [4].

The authors of a 13-month real-world study of reCAPTCHA v2 put it bluntly: they found high cost for users, little security, and concluded the technology should be retired [2].

So who does a CAPTCHA actually stop?

In practice, a CAPTCHA stops two groups: cheap, simple bots, which invisible checks stop just as well, and some of your real customers, who fail or give up. The research on that second group is in is CAPTCHA costing you customers?

Even Cloudflare, one of the largest web security companies, launched a replacement in 2022 (Turnstile) that checks for a human in the background instead of showing puzzles, citing poor user experience, accessibility and privacy [5].

What works better for a contact form

A contact form doesn't need to test your visitors. It needs to recognise how bots behave, on your own server:

1. A hidden trap field that only bots fill in.
2. A minimum time between opening the form and sending it.
3. A signed, one-time token that proves the form was started on your page.
4. Link rules and a rate limit.

None of it asks the visitor anything, none of it sends data to a third party, and together these checks stop almost all automated spam. See the best alternatives to CAPTCHA.