What is a captcha?

What is a captcha?

A captcha is a test that a website presents to determine whether the person on the other side of the screen is a real human being or an automated program, commonly known as a bot. The word is an acronym for Completely Automated Public Turing test to tell Computers and Humans Apart, meaning an automated, public Turing test designed to tell computers and humans apart. When a form asks you to type some distorted letters, tick the "I am not a robot" box, or select every image that contains a traffic light, you are solving a captcha.

These tests first appeared in the late 1990s, when the growth of the internet began to attract programs capable of creating thousands of fake accounts, sending spam email, or harvesting data on a massive scale. Since then, the captcha has become one of the most common barriers between a website and automated traffic. Its appearance has changed a great deal over the years: from the twisted letters of the early days, it moved to a single-click checkbox and, more recently, to verifications that users barely notice.

This article explains what a captcha is for, what types exist, how it works behind the scenes, what advantages and disadvantages it brings to a website, and which modern alternatives, such as invisible verification and passkeys, are gradually replacing it.

What is a captcha for?

The purpose of a captcha is to protect online services from traffic generated by programs. A bot can do in minutes what would take a person hours, which makes automation very attractive to anyone looking to abuse a system. Without a test that filters out programs, any public form is exposed to these risks:

• Spam in comments and forms: bots fill comment sections, guest books, and contact forms with promotional links or fraudulent content.
• Mass account registration: programs create thousands of fake accounts in minutes to drain promotions, rig giveaways, or inflate metrics.
• Brute-force attacks: a bot can try millions of passwords against a login page until it finds the right one.
• Content and data scraping: programs crawl websites at high speed to copy prices, posts, or customer information.
• Bulk purchases of tickets and products: resellers use bots to snap up concert tickets or limited-edition items within seconds.

A captcha does not stop a determined attacker who relies on real human workers, but it does remove the cheapest and most massive problem: automation. By forcing every attempt through a test that only a person can solve easily, the website makes automated operations more expensive and slower.

Types of captcha

Over the years, many variants have appeared, each designed to be hard for a machine yet simple for a person. These are the most common types:

The overall trend has been to move away from tests that demand visual effort and toward models that bother the visitor less. The checkbox click, for example, is rarely the real test: what happens before and after the click is what gives bots away.

How a captcha works

A captcha combines two mechanisms. The first is the visible test, which poses a challenge that a person solves without difficulty but that machines still do not master: reading twisted text, identifying objects in a photo, or following a simple instruction. The second is behavioral analysis, which observes how the cursor moves, how long the user takes to react, which device and IP address the request comes from, and what pattern the movements follow.

Modern systems, such as Google's reCAPTCHA, assign a risk score to every visit. If the score suggests the behavior looks human, the user gets through without seeing anything or with only the checkbox. If there is more doubt, an image test appears; and if the activity looks clearly automated, access is blocked. That is why two people can see different things on the same page: one solves a single click while the other must select nine squares containing bicycles.

This design is deliberate. The visual test is not meant to be impossible for a machine to solve, but expensive and annoying enough that automating it stops being worthwhile. Every time a bot fails an image selection, the site gains information to improve its detection model.

Advantages and disadvantages of captchas

Like any security measure, the captcha has a positive side and a cost that real users pay. These are its main advantages:

• Stops automated spam: it drastically reduces junk comments and fraudulent form submissions.
• Protects accounts: it makes brute-force attacks and mass creation of fake profiles much harder.
• Safeguards server resources: it prevents millions of automated requests from consuming bandwidth and processing power.
• Keeps data quality high: it stops surveys, giveaways, and registrations from filling up with empty or duplicate responses.
• Cheap to implement: the most widely used services offer free versions that any website can integrate.

But it also has drawbacks that are worth knowing:

• User friction: every test interrupts the task and adds seconds, or minutes when the image cannot be understood.
• Form abandonment: many visitors prefer to leave rather than solve a difficult test, which lowers conversion rates.
• Accessibility problems: visual tests exclude people with visual impairments when no proper alternative is provided.
• False positives: legitimate users can be blocked or sent through endless chains of tests without explanation.
• Personal data collection: behavioral analysis gathers information about how each person browses.

Captchas and accessibility

Accessibility is the weakest point of the traditional captcha. A person with low vision cannot read distorted text or identify small objects in a photo, and audio alternatives are often hard to understand or simply missing in many services. This contradicts the very purpose of the test: a mechanism designed to let people through ends up leaving some of them out.

Web accessibility guidelines recommend offering more than one way to pass the test, clearly explaining what the user must do, and avoiding challenges that depend only on sight or hearing. In practice, the best solution has been to reduce the weight of the visual test: the less the system depends on it, the fewer people are left out.

Modern alternatives: invisible verification and passkeys

The natural evolution of the captcha is to disappear from the user's view. Invisible verification already analyzes behavior and the request's environment without asking for any action, reserving visible tests only for genuinely suspicious cases. Many large websites work this way: the visitor never ticks a box, yet the system still tells humans and programs apart.

Another path is to replace the question "are you human?" with the question "are you you?". Passkeys allow users to sign in to an account with the fingerprint, face, or PIN of their own device, with no passwords at all. Because verification is tied to a physical device and a real person, bots lose the chance to steal credentials or automate logins, and the friction of the captcha disappears from the sign-in flow at the same time. Technologies such as WebAuthn are already built into the major browsers and the most popular services.

None of these measures is perfect on its own, and the usual approach is to combine them: invisible verification on forms, IP-based limits, behavioral analysis, and passwordless authentication on sensitive accounts. The captcha will not vanish overnight, but its role is changing: from a visible gatekeeper to a silent last-resort filter.

Understanding what a captcha is helps you appreciate why forms ask for these tests and why so many companies work hard to handle them without bothering the customer. If your business uses web tools to run its daily operations, relying on a trustworthy system, such as Kardex Tauro for inventory control, is also part of protecting your users' information in an environment full of automation.