What Is a CAPTCHA Test? How Modern Checks Work

A CAPTCHA test is a check a website runs to decide whether a request comes from a person or from software. The name stands for "Completely Automated Public Turing test to tell Computers and Humans Apart", and the classic version is a box of distorted letters. Most CAPTCHAs you meet today look nothing like that: many never show a puzzle at all and grade your browser and behaviour instead. This guide covers what a CAPTCHA test is, the types in use now, how they decide, why they fail real people, and how teams that run legitimate test suites and automation deal with them.

What is a CAPTCHA test?

A CAPTCHA test is any automatically generated challenge that most humans can pass and current programs cannot. That definition comes from the people who coined the term: Luis von Ahn, Manuel Blum and John Langford, writing in Communications of the ACM in February 2004, stressed that a CAPTCHA is "a test, any test" with those properties — not specifically an image of text.

Two parts of the name matter. Completely automated means a computer both generates and grades the test, which is why it is sometimes called a reverse Turing test. Public means the method can be published; security comes from the problem being hard for machines, not from keeping the algorithm secret.

Why websites use CAPTCHA tests

Sites use them to make abuse expensive. The places you see them tell you what they protect: sign-up forms (fake accounts), logins (password guessing and credential stuffing), comment boxes and contact forms (spam), checkouts and ticket queues (bots buying stock), and search or pricing pages (high-volume scraping). The 2004 paper already listed free email sign-ups, online polls and search-engine bots as targets; the list has grown but the logic has not changed.

The main types of CAPTCHA test

There are five families in common use, and modern widgets often combine several.

Audio versions exist alongside most visual tests so people who cannot see the images can still pass.

How a CAPTCHA test decides you are human

Modern tests decide mostly from signals, not from your answer. Text and image puzzles grade the answer itself. Checkbox and invisible tests grade the session: the browser environment, how the page was reached, the network address, and how the mouse or touch input behaved. If those signals look normal, you pass without a puzzle. If they look automated, you get a harder challenge or a lower score.

Score-based systems such as reCAPTCHA v3 never block on their own. They return a score with each token, and the site decides what to do — let a high score through, ask a low score for a second factor, or reject it. The token is the proof that the test ran, and the site's server verifies it with the CAPTCHA provider. For reCAPTCHA, Google's verification docs say each token is valid for two minutes and can be verified only once.

Cloudflare has gone furthest in this direction: its challenge documentation states that it no longer uses visual puzzles at all and relies on browser signals and, at most, a click. That is the "Verifying you are human" screen many people now think of as the CAPTCHA.

A short history

CAPTCHAs went from text puzzles to invisible scoring in about twenty years. The term and the formal definition date from the early 2000s at Carnegie Mellon. reCAPTCHA started as a project that used the answers to digitise books — Cloudflare's learning centre notes it sourced words from scanned books and newspapers — and was acquired by Google in 2009. Image grids, the checkbox and then score-only versions followed as machine reading got better at distorted text. Each step moved the test away from "solve this" and towards "behave like a person while we watch".

Why CAPTCHA tests fail real people

Because the modern test grades the session, ordinary privacy and accessibility choices can look suspicious. Common reasons a real person fails or loops:

• a VPN or shared network address with a poor reputation;
• blocked cookies or JavaScript, so a passed check is never remembered;
• privacy extensions that change what the browser reports;
• assistive technology or keyboard-only navigation that does not move like a mouse;
• visual puzzles that are hard to see, with audio alternatives that are hard to hear.

That last point is why many site owners have moved to invisible checks: fewer people ever see a puzzle. The trade-off is that a failed invisible check is harder to understand, because there is nothing visible to retry.

How QA teams and automation handle CAPTCHA tests

For your own site, do not solve your own CAPTCHA in tests — switch it off or use the provider's test keys. Google publishes a reCAPTCHA v2 test site key and secret in its reCAPTCHA FAQ that always pass verification and show a warning that they are not for production; for v3 it recommends a separate key for test environments. Cloudflare offers equivalent Turnstile test keys.

For third-party sites you are authorised to automate — monitoring your own listings on a marketplace, collecting public data where permitted, end-to-end tests against a partner's staging system — a solving API returns the token the real widget would have produced. The parts that decide whether that token is accepted are the same session signals described above: send it from the same IP and user agent, and soon after it was issued. We cover that in detail in why captcha tokens get rejected.

How CaptchaNo fits in

CaptchaNo is a CAPTCHA solving API for that second case. One endpoint handles reCAPTCHA v2 and v3, Cloudflare Turnstile, DataDome and image-to-text CAPTCHAs on our own solving infrastructure, and you pay only for successful solves. Definitions of the terms used here — sitekey, token, score, challenge page — are in the captcha glossary, and the request format is in the API reference.

Frequently Asked Questions

What does CAPTCHA stand for?

CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart". It is called automated because a computer creates and grades the test, and public because the method can be published without making the test easier to defeat. The term was formalised by researchers at Carnegie Mellon in the early 2000s.

Is reCAPTCHA the same as CAPTCHA?

reCAPTCHA is one CAPTCHA product, made by Google, rather than a different idea. CAPTCHA is the general category of human-versus-bot tests. reCAPTCHA comes in several versions: v2 with the checkbox and image grids, an invisible v2, and v3, which shows nothing and returns a score that the website uses to decide what to do.

Why do I keep failing CAPTCHA tests?

Modern tests grade your session as much as your answer. A VPN, blocked cookies or JavaScript, aggressive privacy extensions and some assistive tools can all make an ordinary visit look automated. Trying without the VPN, allowing cookies for the site and disabling extensions usually fixes repeated failures, and the audio option helps if images are hard to read.

Can a CAPTCHA test be solved automatically?

Yes, which is why providers keep changing them. Text CAPTCHAs fell to machine reading years ago, and solving services return valid tokens for image and checkbox challenges. Modern systems respond by grading the session around the token, so an automatically solved CAPTCHA only works when it is used from a consistent, legitimate session on a site you are allowed to automate.

How do I test a form that has a CAPTCHA?

Use the provider's test configuration instead of solving the real challenge. Google publishes reCAPTCHA v2 test keys that always pass and recommends a separate key for v3 in test environments, and Cloudflare offers Turnstile test keys. You can then test the form's own logic, including rejection of missing or expired tokens, without depending on a live challenge.

Solve CAPTCHA tests in your own automation

If your automation is authorised and a CAPTCHA keeps stopping it, try CaptchaNo free for three days. Per-type rates are on the pricing page.