CAPTCHA
CAPTCHA — Completely Automated Public Turing test to tell Computers and Humans Apart. A challenge easy for humans, hard for bots, that controls access to a site.
Privacy-First CAPTCHA
Protect users without compromising their privacy
What is CAPTCHA?
A CAPTCHA is a test a website uses to establish that a person is present rather than a script. The acronym stands for Completely Automated Public Turing test to tell Computers and Humans Apart, which is a fair description of the original idea: a task easy for people and hard for machines.
That premise has weakened considerably. Machine vision now reads distorted text and identifies objects in photographs better than many people do, which is why the modern products ask the user to do less, not more.
How one works
Every CAPTCHA is a challenge-response exchange with three steps: the server issues a challenge, the client returns a response, and the server verifies it. The third step is where the protection is — a site that renders a widget and never calls the verification endpoint has no protection at all, and that is the most common deployment error there is.
The generations
| Generation | What the user does | Why it was superseded |
|---|---|---|
| Distorted text | Reads warped characters | OCR solves it more accurately than people |
| Image grids | Picks traffic lights, crossings, buses | Machine vision solves it; solving services sell the rest cheaply |
| Checkbox with risk scoring | Clicks a box, sometimes gets a puzzle | Depends on third-party tracking to produce the score |
| Invisible | Nothing | Current approach. Strength depends entirely on the signals behind it |
| Proof of work | Nothing, waits briefly | Current. Charges cost per attempt rather than identifying anyone |
The progression is not really about making puzzles harder. It is the recognition that asking the user anything is a cost, and that the useful evidence was never the puzzle answer.
The real costs
Visible CAPTCHAs are expensive in ways that do not appear on an invoice.
They exclude people. Image grids are difficult or impossible with a visual impairment, audio alternatives are unreliable, and timed puzzles penalise motor and cognitive differences. They land at the worst moment — at checkout and sign-up, where the user is most committed and most likely to abandon. And they are routinely defeated anyway, since farms pay people to solve them in bulk for a few dollars per thousand.
There is also a data cost that privacy reviews catch: several widely deployed CAPTCHAs are advertising companies, the scoring depends on recognising the user across sites, and that is processing you have to justify under GDPR.
What to look for instead
- Invisible by default, with a visible challenge only for genuinely ambiguous sessions
- Server-side verification, with single-use tokens and a short expiry
- A straight answer on where data is processed and what is retained
- No dependence on third-party tracking cookies
- An accessible path that is not an audio puzzle
That is the specification Procaptcha was built to, and the comparisons on this site — reCAPTCHA and hCaptcha — set out where the alternatives differ.