What Is a CAPTCHA? A Test Designed to Be Failed by Machines

The problem is automation at scale. A script can create thousands of accounts, post advertising in comment sections, scrape content, buy every ticket for resale, attempt passwords against many accounts, or submit forms endlessly, and all of these are cheap for the attacker and expensive for the site. A test that costs a human three seconds and a machine either significant computation or a real payment changes the economics, which is the point: the aim is rarely to make automation impossible and usually to make it expensive enough that the attack is no longer worth running. The name is an acronym for a completely automated public test to tell computers and humans apart, coined at Carnegie Mellon around 2000, and the underlying idea has a neat property that the researchers pointed out at the time: any CAPTCHA that is broken represents progress in artificial intelligence, so the test is either useful as a defence or useful as a research result.

Each generation was defeated and replaced by one exploiting a different gap between human and machine ability:

• •Distorted text, warped, overlapped and crossed with lines, defeated progressively by better optical character recognition until the distortion needed to stop machines was also stopping people
• •reCAPTCHA, which used words that optical character recognition had failed to read from scanned books, showing one known word and one unknown, so that millions of solved puzzles digitised archives as a side effect
• •Image selection, asking which squares contain a bus or a crossing, which similarly generated training data for machine vision while acting as a test
• •Simple arithmetic, logic questions and hidden form fields that only a script would fill, all cheap and easily defeated by a targeted attacker while still filtering unsophisticated bots
• •Behavioural analysis, the current mainstream, which watches mouse movement, timing, browser characteristics and account history and mostly shows no puzzle at all
• •Proof of work, requiring the visitor's device to perform a computation that costs a trivial amount for one visit and a great deal for a million, which makes no demand on the user's attention

Two pressures undermine every design. The first is that machine vision and speech recognition have improved to the point where the best systems outperform people on exactly the tasks these tests use, so distorted text and image identification are solved problems for a well-resourced attacker. The second is economic and defeats the whole concept rather than any particular test: CAPTCHA solving services employ people, typically in low-wage countries, who solve puzzles relayed to them by attacking software at rates of a fraction of a cent each. Against that business model no test based on human ability can succeed, because the attacker simply buys human ability. This is why the field moved towards signals that are hard to relay, including behaviour during the session and reputation attached to the device or account, and why the practical question is no longer whether a visitor can solve a puzzle but whether the traffic looks like it comes from where it claims.

The burden falls unevenly and the accessibility problems are serious. Distorted text is difficult or impossible for people with visual impairments, and audio alternatives have historically been worse, being noisy and frequently harder than the visual version. Image tasks assume cultural familiarity, so identifying a fire hydrant or a crossing of a particular design is not equally easy everywhere. Cognitive and motor impairments make timed and fiddly interactions harder. Behavioural systems create a different problem: they penalise visitors who look unusual, including people using privacy tools, older browsers, shared connections or networks in certain countries, who are shown harder challenges or blocked entirely without explanation or appeal. Research measuring aggregate time spent on these tests puts the global figure at an extraordinary number of human hours. Alternatives under development include cryptographic attestation, where a device proves it is a real device without identifying the user, which trades the puzzle for a dependency on the companies that issue the attestations.

A CAPTCHA aims to make automation expensive rather than impossible, by exploiting a gap between human and machine ability. Distorted text gave way to image selection, both of which doubled as training data for the very systems that defeated them, and current defences mostly watch behaviour and show no puzzle. The decisive weakness is economic: solving services pay people a fraction of a cent per puzzle, so no test based purely on human ability can hold. The costs fall hardest on disabled users and unusual-looking traffic.