CAPTCHA - Telling Humans and Bots Apart

About 2 min read

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is an authentication test designed to determine whether the visitor is a human or a bot. By deploying it on login forms and sign-up pages, it suppresses automated attacks such as credential stuffing and brute-force attacks. As of 2025, "invisible CAPTCHA," which requires no user interaction, is becoming mainstream.

Real-World Use Cases

"Our sign-up form was hit by bots creating massive numbers of spam accounts. After introducing reCAPTCHA v3 and blocking requests with a score below 0.5, spam registrations dropped by 98%. Since legitimate users were never shown a CAPTCHA challenge, there was no impact on the conversion rate."

The Evolution of CAPTCHA

Early CAPTCHAs required reading distorted text images, but advances in OCR technology made them increasingly easy to defeat. reCAPTCHA v2 combines an "I'm not a robot" checkbox with image-selection tasks, while reCAPTCHA v3 scores user behavior patterns (mouse movement, scroll speed, time spent on the page) and makes its judgment in the background. hCaptcha is seeing growing adoption as a privacy-conscious alternative service.books on bot countermeasures (Amazon) offer a systematic way to learn more.

Considerations for Deployment

CAPTCHA is a trade-off between security and user experience. An overly difficult CAPTCHA lowers conversion rates and becomes an accessibility barrier for visually impaired users. By offering audio CAPTCHAs or adopting score-based methods, you can keep the burden on users to a minimum while maintaining defensive effectiveness. By combining rate limiting with CAPTCHA, you can design a system that shows no CAPTCHA to ordinary users and requires one only from bots that send large numbers of requests in a short time. In defending against credential stuffing, CAPTCHA is one of the important defensive measures.

The Limitations of CAPTCHA

Due to CAPTCHA-solving services (services where humans manually solve CAPTCHAs on your behalf) and advances in image recognition, CAPTCHA alone has its limits as a defense. Combine the strong passwords generated on passtsuku.com with CAPTCHA to build a layered defense.books on authentication security (Amazon) are also a helpful reference.