What Is CAPTCHA and How Does It Work? Every Type Explained

March 15, 2026 Comments Off on What Is CAPTCHA and How Does It Work? Every Type Explained
what is captcha - What Is CAPTCHA and How Does It Work?

A CAPTCHA is a test a website uses to tell a person apart from a script. If you’ve clicked “I’m not a robot”, retyped warped letters from an image, or picked every square with a traffic light in it, you’ve taken one. Plenty of them you never see, because the modern ones decide in the background and only interrupt when something looks off.

So what is CAPTCHA in practice? Here’s what the acronym stands for, the six types you’ll actually run into, and how each one makes its decision.

What CAPTCHA stands for

CAPTCHA is short for Completely Automated Public Turing test to tell Computers and Humans Apart. Long name, simple idea: show a task people find easy and software finds hard.

The “hard for software” half is the part that keeps moving. Warped-text puzzles were genuinely difficult for a machine in 2003. Character recognition caught up, so the tests moved to images, then to behaviour, then to scoring you without showing anything at all. Each generation exists because the previous one stopped working.

The six types you’ll actually meet

Almost every CAPTCHA on the web is one of these.

1. Text CAPTCHA

Distorted letters and digits inside an image. You retype what you see. It’s the original format and it’s fading, because character recognition handles it well now. You’ll still hit it on older forums, legacy government portals and internal tools. Reading one programmatically is what an image CAPTCHA solver does.

2. Image selection

A grid of photos and an instruction: pick the buses, the crosswalks, the bicycles. This is the format most people picture when they hear the word. Usually it’s reCAPTCHA escalating, because something about the request already looked automated.

3. Checkbox

The “I’m not a robot” tickbox. The click itself proves almost nothing. What matters is everything measured around it: how the cursor arrived, what the browser looks like, what that IP has been doing lately. Pass and you’re through. Fail and you get the image grid.

4. Invisible

Same machinery, no checkbox. Verification fires when the page loads or the form submits. Most visitors never see anything, and a challenge appears only when the signals are weak.

5. Score-based

No puzzle at any point. The system returns a number estimating how human the interaction looked, and the site decides what to do with it: allow, challenge, or block. It’s easier on visitors and considerably more work for whoever implements it, because the site now owns the threshold logic.

6. Cloudflare Turnstile

Cloudflare’s alternative, built to verify with as little visible interaction as possible. It appears as a small widget inside a form, or as a full-page interstitial while a challenge runs. Our page on Cloudflare Turnstile covers how those two modes differ in practice.

You can try live versions of all of these on our CAPTCHA demo pages.

How a CAPTCHA decides

In the page, a CAPTCHA is normally one container element and one script:

<!-- A reCAPTCHA v2 checkbox: one div, one script. -->
<div class="g-recaptcha" data-sitekey="YOUR_SITEKEY"></div>

<script src="https://www.google.com/recaptcha/api.js"
        async defer></script>

<!-- On success the widget writes a token into a hidden field
     called g-recaptcha-response, which posts with the form. -->

The visible puzzle, when there is one, is the smallest part. Behind it the provider is weighing signals that you never interact with directly:

  • mouse movement, scrolling and typing rhythm
  • browser and device characteristics
  • how many requests have come from that IP, and what they did
  • cookies and prior history with the provider
  • timing, such as a form submitted faster than a person could read it

Then the outcome travels as a token. The widget hands your browser a short-lived string, the form posts it, and the site’s backend exchanges that token with the provider to find out whether you passed. Nothing is decided in your browser, which is why editing the page never gets you through.

Why websites use CAPTCHA

Because automated abuse is cheap and fast. One script can fire thousands of requests at a form in the time a person fills it in once. Without a check in front, small sites get hit as readily as large ones.

The usual targets:

  • spam through contact and comment forms
  • fake account registration
  • credential stuffing against login pages
  • scraping content, prices or listings
  • abuse of free trials, coupons and giveaways
  • checkout and inventory hoarding

A CAPTCHA doesn’t make any of that impossible. It makes it expensive enough that most opportunistic attempts go elsewhere.

Why they frustrate people

Because the cost lands on everyone, not just the bots. Common complaints, all legitimate:

  • the grid that keeps reloading no matter what you click
  • text too distorted to read
  • challenges that fire on every page, not just risky ones
  • false positives on VPNs, shared office IPs and privacy browsers
  • screen readers and motor impairments handled poorly

That’s the real tradeoff. Turn protection up and you block more abuse and more customers. It’s why the industry keeps moving toward invisible and score-based checks: same protection, less of it aimed at people who were never the problem.

CAPTCHA is one layer, not the whole defence

Modern anti-bot stacks rarely stop at a CAPTCHA. Around it sit rate limiting, IP reputation, browser fingerprinting, device checks, behavioural analysis and session monitoring.

That’s why two sites using the same provider behave completely differently. The provider supplies a signal. Each site sets its own thresholds, and its own answer to what a weak signal should cost you.

It also explains the frustrating asymmetry where one site waves you straight through and another shows you four image grids in a row on the same connection.

Frequently asked questions

What is CAPTCHA in simple words?

A test a website uses to check whether a visitor is a person rather than a script. It might be a puzzle, a checkbox, or a silent background check you never notice.

Why do websites use CAPTCHA?

To cut spam, fake signups, brute-force logins, scraping and other automated abuse. It works by making each attempt cost something, so mass automation stops being cheap.

What are the main types of CAPTCHA?

Text, image selection, checkbox, invisible, score-based, and Cloudflare Turnstile. The first two show you a puzzle. The rest decide mostly or entirely from signals you never see.

Is CAPTCHA always visible?

No. Invisible and score-based systems run without showing anything, and only surface a challenge when the request looks suspicious. If a site feels like it has no CAPTCHA, it may simply be one you keep passing.

Does CAPTCHA stop all bots?

No, and it isn’t meant to. It raises the cost of automation. Determined attackers get through, which is exactly why it sits alongside rate limiting, fingerprinting and reputation checks rather than replacing them.

Summary

A CAPTCHA is a cheap filter between a visitor and an action. The visible puzzle is the small part, the signals around it do most of the work, and the result travels as a token your browser can’t forge. Six formats cover almost everything you’ll meet, and the trend is firmly toward the ones you never see.

Google’s implementation is the one you’ll hit most, and it gets its own explainer in what reCAPTCHA is and how it works. If you’re on the other side of this, handling challenges inside a crawler or a test suite, see CAPTCHA handling for web scraping. CapSkip itself is an unlimited captcha solver that runs on your own machine.