{
	"id": "fd682222-bf0c-4fdb-a453-3704befcd511",
	"created_at": "2026-10-14T02:03:35.023707Z",
	"updated_at": "2026-10-20T09:14:46.468689Z",
	"deleted_at": null,
	"sha1_hash": "7b253447d242742a19a01ef10f2e10bf09b82930",
	"title": "How CAPTCHAs Work | What Does CAPTCHA Mean?",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 354606,
	"plain_text": "https://www.cloudflare.com/learning/bots/how-captchas-work/\n\nHow CAPTCHAs Work | What Does CAPTCHA Mean?\n\nArchived: 2026-10-14 02:01:00 UTC\n\nWhat is a CAPTCHA?\n\nA CAPTCHA test is designed to determine if an online user is really a human and not a bot. CAPTCHA is an\n\nacronym that stands for \"Completely Automated Public Turing test to tell Computers and Humans Apart.\" Users\n\noften encounter CAPTCHA and reCAPTCHA tests on the Internet. Such tests are one way of managing bot\n\nactivity, although the approach has its drawbacks.\n\nAlthough CAPTCHAs are designed to block automated bots, CAPTCHAs are themselves automated. They're\n\nprogrammed to pop up in certain places on a website, and they automatically pass or fail users.\n\nHow does a CAPTCHA work?\n\nClassic CAPTCHAs, which are still in use on some web properties today, involve asking users to identify letters.\n\nThe letters are distorted so that bots are not likely to be able to identify them. To pass the test, users have to\n\ninterpret the distorted text, type the correct letters into a form field, and submit the form. If the letters don't match,\n\nusers are prompted to try again. Such tests are common in login forms, account signup forms, online polls, and e-\n\ncommerce checkout pages.\n\ncaptcha example\n\nThe idea is that a computer program such as a bot will be unable to interpret the distorted letters, while a human\n\nbeing, who is used to seeing and interpreting letters in all kinds of contexts – different fonts, different\n\nhandwritings, etc. – will usually be able to identify them.\n\nPage 1 of 6\n\nhttps://www.cloudflare.com/learning/bots/how-captchas-work/\n\nThe best that many bots will be able to do is input some random letters, making it statistically unlikely that they\n\nwill pass the test. Thus, bots fail the test and are blocked from interacting with the website or application, while\n\nhumans are able to continue using it like normal.\n\nAdvanced bots are able to use machine learning to identify these distorted letters, so these kinds of CAPTCHA\n\ntests are being replaced with more complex tests. Google reCAPTCHA has developed a number of other tests to\n\nsort out human users from bots.\n\nWhat is reCAPTCHA?\n\nreCAPTCHA is a free service Google offers as a replacement for traditional CAPTCHAs. reCAPTCHA\n\ntechnology was developed by researchers at Carnegie Mellon University, then acquired by Google in 2009.\n\nreCAPTCHA is more advanced than the typical CAPTCHA tests. Like CAPTCHA, some reCAPTCHAs require\n\nusers to enter images of text that computers have trouble deciphering. Unlike regular CAPTCHAs, reCAPTCHA\n\nsources the text from real-world images: pictures of street addresses, text from printed books, text from old\n\nnewspapers, and so on.\n\nrecaptcha example\n\nOver time, Google has expanded the functionality of reCAPTCHA tests so that they no longer have to rely on the\n\nold style of identifying blurry or distorted text. Other types of reCAPTCHA tests include:\n\nImage recognition\n\nCheckbox\n\nGeneral user behavior assessment (no user interaction at all)\n\nHow does an image recognition reCAPTCHA test work?\n\nFor an image recognition reCAPTCHA test, typically users are presented with 9 or 16 square images. The images\n\nmay all be from the same large image, or they may each be different. A user has to identify the images that contain\n\ncertain objects, such as animals, trees, or street signs. If their response matches the responses from most other\n\nusers who have submitted the same test, the answer is considered \"correct\" and the user passes the test.\n\nPage 2 of 6\n\nhttps://www.cloudflare.com/learning/bots/how-captchas-work/\n\nimage recaptcha\n\nPicking out certain objects from blurry photos is a hard problem for computers to solve. Even advanced artificial\n\nintelligence (AI) programs struggle with it – so a bot will struggle with it as well. However, a human user should\n\nPage 3 of 6\n\nhttps://www.cloudflare.com/learning/bots/how-captchas-work/\n\nbe able to do this fairly easily, since humans are used to perceiving everyday objects in all kinds of contexts and\n\nsituations.\n\nHow do reCAPTCHA tests with a single checkbox work?\n\nSome reCAPTCHA tests simply prompt the user to check a box next to the statement, \"I'm not a robot.\" However,\n\nthe test is not the actual action of clicking the checkbox – it's everything leading up to the checkbox click.\n\nNot a Robot captcha\n\nThis reCAPTCHA test takes into account the movement of the user's cursor as it approaches the checkbox. Even\n\nthe most direct motion by a human has some amount of randomness on the microscopic level: tiny unconscious\n\nmovements that bots can't easily mimic. If the cursor's movement contains some of this unpredictability, then the\n\ntest decides that the user is probably legitimate. The reCAPTCHA also may assess the cookies stored by the\n\nbrowser on a user device and the device's history in order to tell if the user is likely to be a bot.\n\nIf the test is still unable to determine whether or not the user is a human, it may present an additional challenge,\n\nsuch as the image recognition test described above. However, most of the time the user's cursor movements,\n\ncookies, and device history are conclusive enough.\n\nHow does reCAPTCHA work without any user interaction?\n\nThe latest versions of reCAPTCHA are able to take a holistic look at a user's behavior and history of interacting\n\nwith content on the Internet. Most of the time, the program can decide based on those factors whether or not the\n\nuser is a bot, without providing the user with a challenge to complete. If not, then the user will get a typical\n\nreCAPTCHA challenge.\n\nGoogle offers a monthly paid service called reCAPTCHA Enterprise, which uses a score-based detection system\n\nto distinguish between humans and bots. reCAPTCHA Enterprise interacts with the customer backend and\n\nwebpages to trigger a sequence of JavaScript, HTML, and token authentication events. The system then derives\n\nthe visitor’s risk “score”, from 0.0 through 1.0, and the website developer determines what action should be taken\n\nbased on the score.\n\nThe lower the score, the more likely the “visitor” is actually a bot. A reCAPTCHA Enterprise score of 0.0\n\nindicates that the interaction might be fraudulent and high risk, whereas 1.0 indicates that the interaction is very\n\nlikely legitimate and low risk.\n\nPage 4 of 6\n\nhttps://www.cloudflare.com/learning/bots/how-captchas-work/\n\nWhat triggers a CAPTCHA test?\n\nSome web properties just automatically have CAPTCHAs in place as a proactive defense against bots. Other\n\ntimes, a test may be triggered if user behavior seems to resemble a bot's behavior: if users request webpages or\n\nclick hyperlinks at a far higher rate than average, for instance.\n\nAre CAPTCHAs and reCAPTCHAs enough for stopping malicious bots?\n\nSome bots can get past the text CAPTCHAs on their own. Researchers have demonstrated ways to write a\n\nprogram that beats the image recognition CAPTCHAs as well. In addition, attackers can use click farms to beat\n\nthe tests: thousands of low-paid workers solving CAPTCHAs on behalf of bots.\n\nBesides a CAPTCHA, there need to be other strategies in place for stopping unwanted bots (such as content\n\nscraping bots, credential stuffing bots, or spam bots).\n\nWhat are the drawbacks of using CAPTCHAs or reCAPTCHAs to stop bots?\n\nBad user experience: A CAPTCHA test can interrupt the flow of what users are trying to do, giving them a\n\nnegative view of their experience on the web property, and leading to them abandoning the webpage altogether in\n\nsome cases.\n\nNot usable for visually impaired individuals: The problem with CAPTCHAs is that they rely on visual\n\nperception. This makes them nearly impossible, not just for people who are legally blind, but for anyone with\n\nseriously impaired vision.\n\nThese tests can be fooled by bots: As described above, CAPTCHAs are not fully bot-proof and shouldn't be\n\nrelied upon for bot management.\n\nAre there alternatives to using CAPTCHAs or reCAPTCHAs?\n\nBot management solutions such as Cloudflare Bot Management or Super Bot Fight Mode can identify bad bots\n\nwithout impacting the user experience, based on the behavior of the bot. This way, bots can be mitigated without\n\nforcing users to complete CAPTCHAs.\n\nCloudflare also offers Turnstile, an invisible alternative to CAPTCHA that uses a snippet of free code. Turnstile is\n\navailable to anyone — usage does not require being a Cloudflare customer.\n\nAs millions of users identify hard-to-read text and pick out objects in blurry images, that data is fed into AI\n\ncomputer programs so that they become better at those tasks as well.\n\nIn general, computer programs struggle with identifying objects and letters in different contexts, because context\n\ncan change almost infinitely in the real world. For instance, a stop sign is a red octagon with white letters reading\n\n\"STOP.\" A computer program could identify a shape-and-word combination like that fairly easily. However, a stop\n\nsign in a photo may look very different from that simple description depending on context: the angle of the photo,\n\nthe lighting, the weather involved, and so on.\n\nPage 5 of 6\n\nhttps://www.cloudflare.com/learning/bots/how-captchas-work/\n\nVia machine learning, AI programs can get better at overcoming these limitations. For the stop sign example, the\n\nprogrammer would feed the AI program a bunch of data on what is and is not a stop sign. For this to be effective,\n\nthey need lots of examples of images with stop signs and images without stop signs, and they need human users to\n\nidentify them until the program has enough data to be effective at it.\n\nreCAPTCHA helps fill this need by getting humans to identify objects and texts, which slowly provides enough\n\ndata to build robust AI programs.\n\nWhat is a Turing test? How are Turing tests relevant to CAPTCHA tests?\n\nA Turing test assesses a computer's ability to mimic human behavior. Alan Turing, an early computing pioneer,\n\ninvented the concept of a Turing test in 1950. A computer program \"passes\" the Turing test if its performance\n\nduring the test is indistinguishable from that of a human – if it acts the way that a human would act. A Turing test\n\nis not dependent on getting answers correct; it's about how \"human\" the answers sound, regardless of whether\n\nthey're right or wrong.\n\nAlthough it's called a \"Public Turing test,\" a CAPTCHA is really the opposite of a Turing test – it determines\n\nwhether a supposedly human user is actually a computer program (a bot) or not, instead of trying to determine if a\n\ncomputer is human. To accomplish this, a CAPTCHA needs to assign a brief task that people tend to be good at\n\nand computers struggle with. Identifying text and images usually fits those criteria.\n\nSource: https://www.cloudflare.com/learning/bots/how-captchas-work/\n\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.cloudflare.com/learning/bots/how-captchas-work/"
	],
	"report_names": [
		"how-captchas-work"
	],
	"threat_actors": [],
	"ts_created_at": 1791943415,
	"ts_updated_at": 1792487686,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7b253447d242742a19a01ef10f2e10bf09b82930.pdf",
		"text": "https://archive.orkl.eu/7b253447d242742a19a01ef10f2e10bf09b82930.txt",
		"img": "https://archive.orkl.eu/7b253447d242742a19a01ef10f2e10bf09b82930.jpg"
	}
}