CAPTCHA - Telling Humans and Bots Apart

About 2 min read

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is an authentication test designed to determine whether the visitor is a human or a bot. By deploying it on login forms and sign-up pages, it suppresses automated attacks such as credential stuffing and brute-force attacks. As of 2025, "invisible CAPTCHA," which requires no user interaction, is becoming mainstream.

What a Surge of Spam Sign-Ups Tells You

When a sign-up form starts producing an unnatural number of new accounts in a short time, the first suspicion should be not a sudden influx of users but bots automating the form to mass-produce spam accounts. Accounts created this way become a foothold for spam posts and abuse, so the registration step needs a way to check whether a human is actually operating the form. CAPTCHA is a tool for exactly this situation: by holding back only the automated registrations, it keeps whatever sits behind the form available to human users.

The Evolution of CAPTCHA

Early CAPTCHAs required reading distorted text images, but advances in OCR technology made them increasingly easy to defeat. reCAPTCHA v2 combines an "I'm not a robot" checkbox with image-selection tasks, while reCAPTCHA v3 scores user behavior patterns (mouse movement, scroll speed, time spent on the page) and makes its judgment in the background. hCaptcha is seeing growing adoption as a privacy-conscious alternative service.

Considerations for Deployment

CAPTCHA is a trade-off between security and user experience. An overly difficult CAPTCHA lowers conversion rates and becomes an accessibility barrier for visually impaired users. By offering audio CAPTCHAs or adopting score-based methods, you can keep the burden on users to a minimum while maintaining defensive effectiveness. By combining rate limiting with CAPTCHA, you can design a system that shows no CAPTCHA to ordinary users and requires one only from bots that send large numbers of requests in a short time. In defending against credential stuffing, CAPTCHA is one of the important defensive measures.

The Limitations of CAPTCHA

Due to CAPTCHA-solving services (services where humans manually solve CAPTCHAs on your behalf) and advances in image recognition, CAPTCHA alone has its limits as a defense. Combine the strong passwords generated on passtsuku.com with CAPTCHA to build a layered defense.