.png){kind=logo}
CAPTCHA checks remain a familiar part of using the internet. From ticking an ‘I’m not a robot’ box to identifying traffic lights in a grid of images, these tests aim to distinguish humans from automated bots.
Modern AI changed the equation. Traditional image-based CAPTCHAs face growing challenges from AI tools and automated solving services. As a result, websites increasingly use invisible, score-based systems such as Google’s reCAPTCHA v3 and Cloudflare Turnstile, which assess user behavior rather than relying only on visible puzzles.
The acronym CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a security feature widely implemented in online forms, registration pages, and login interfaces to verify user authenticity and ensure they are human, not bots.
CAPTCHAs have gone through many iterations since their introduction. Initially, they were based on distorted text, images, or sounds that would be easier for people to recognize than for machines.
Nowadays, CAPTCHA refers to a group of technologies, including Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, GeeTest, and FunCaptcha.
The traditional CAPTCHA asks people to recognize distorted characters, choose specified items within images, or type an audio snippet. With advances in AI technology, the underlying assumption that computers would find it hard to complete those tasks has become questionable.
Also Read: Hackers Use BNB Chain and Fake CAPTCHAs to Spread Windows Malware
Under the reCAPTCHA v2 scheme, users click the ‘I’m not a robot’ checkbox, which is accompanied by analysis of factors such as mouse movements, browsing history, and cookies. If there is any suspicious behavior, the user may be offered an additional image-based challenge.
In turn, reCAPTCHA v3 operates more discreetly in the background. It analyzes behavioral and contextual factors, such as movement across the page, session history, and device signals. Then, a score ranging from 0 to 1 is assigned, where values close to 1 indicate human, whereas values close to 0 indicate bots.
Cloudflare Turnstile and other solutions analyze only browser signals and make small cryptographic computations.
The answer is increasingly yes. AI-powered systems can claim accuracy rates of up to 99% on a given CAPTCHA type. Commercial “CAPTCHA farms” also use low-paid human workers or cheaper software to solve challenges at scale.
People give up on CAPTCHA puzzles roughly 15% of the time. Audio CAPTCHAs, intended as an accessibility option, also proved weak: bots solved them correctly more than 85% of the time in one test. By comparison, independent reviewers agreed on the ‘correct’ answer only around 31% of the time.
Underground CAPTCHA farms charge roughly $1–3 per 1,000 hCaptcha-style image solves and $1–2 per 1,000 tokens for Cloudflare Turnstile.
CAPTCHA remains useful since attackers can cheaply deploy bots to generate thousands of malicious requests, while defending against every request is more difficult and expensive.
Websites use these systems to prevent credential stuffing, automated account creation, comment spam, scalping bots, checkout abuse, web scraping, phishing, and scam attempts.
The industry is now moving away from visible puzzles toward invisible, score-based and proof-of-work verification. For most users, visible CAPTCHA challenges are increasingly reserved for high-risk interactions.
