On this page
You have typed wobbly letters, clicked every square with a traffic light and ticked "I'm not a robot". Each of these is a CAPTCHA, and each rests on one idea: find a task that people do easily and computers cannot. That idea worked for about a decade. Then AI learned to see.
What does CAPTCHA stand for?
CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart", as Luis von Ahn and colleagues spell it out in a 2008 paper in Science.
The idea was set out formally in a 2003 paper by Luis von Ahn, Manuel Blum, Nicholas Hopper and John Langford titled "CAPTCHA: Using Hard AI Problems for Security". The title is the whole trick: use a problem AI cannot yet solve as a lock.
The name borrows from the Turing test, which we explain in what the Turing test is and whether AI has passed it. A CAPTCHA flips the roles: the judge is a computer, and it marks your answer automatically.
How does CAPTCHA work?
Every CAPTCHA has three parts:
A challenge the website can generate in endless variety: warped text, a grid of photos, a slider puzzle.
An answer the website can check by itself, with no person reading it.
A bet that a program cannot find that answer cheaply.
The reCAPTCHA team added a twist. Instead of random letters, they showed people scanned words from old books that character-recognition software had failed to read. Their Science paper reports word accuracy above 99%, use on more than 40,000 websites and over 440 million words transcribed.
Why can AI solve CAPTCHAs now?
Because the bet stopped paying. Google researchers trained a deep neural network to read house numbers in Street View photos and then tested it on synthetic distorted text from reCAPTCHA; their 2013 paper reports 99.8% accuracy on the hardest category.
Photo grids went the same way. Andreas Plesner, Tobias Vontobel and Roger Wattenhofer used YOLO image-recognition models on Google's reCAPTCHA v2 and solved 100% of the captchas, where earlier work had solved 68 to 71%.
The clearest comparison comes from a 2023 USENIX Security study in which 1,400 participants solved 14,000 real CAPTCHAs. Set beside published bot attacks:
Distorted text: people took 9 to 15.3 seconds and agreed on the answer 50 to 84% of the time; bots take under a second at 99.8% accuracy.
reCAPTCHA click: people took 3.1 to 4.9 seconds; bots, 1.4 seconds.
hCAPTCHA: people took 18 to 32 seconds; bots, 14.9 seconds.
The authors write that these results suggest bots can outperform humans in both solving time and accuracy across these types.
If the idea of a network learning to see from examples is new to you, the Fermi Concept Library covers every concept in mathematics and computing, each with its own lesson.
How do websites tell humans from bots now?
They watch instead of asking. Google's reCAPTCHA v3 developer guide says it returns a score for each request without interrupting you: 1.0 means very likely a good interaction and 0.0 very likely a bot. The guide suggests sites start with a threshold of 0.5, and use a low score to ask for something extra, such as email verification or two-factor authentication.
The tick box leans on the same kind of evidence. The 2024 reCAPTCHA v2 study found evidence that it relies heavily on cookie and browser history data when judging whether you are human. That may explain a common puzzle: the box waves you through at home, then throws image after image at you in a fresh private window.
What should you do when a CAPTCHA keeps appearing?
Use this checklist:
Read the instruction word for word. "Squares with a bus" includes the square with only a bumper.
Expect more challenges in a private window or right after clearing cookies, since reCAPTCHA appears to weigh cookies and browser history. Your usual browser may get fewer.
Use the refresh or audio option when an image is unclear, rather than guessing.
Never paste anything a verification page asks you to paste. A known scam shows a fake "verify you are human" box that tells you to open the Windows Run dialog, paste and run a command; Malwarebytes explains how this installs information-stealing malware. A real CAPTCHA only asks you to click, type or drag on the page.
If you already ran such a command, change your passwords from another device, turn on two-step verification for your study accounts and report it through India's cybercrime helpline and portal.
Next time a box asks whether you are a robot, remember that most of the test already happened before you clicked.
