How does "I'm not a robot" know?
You tick one box and it believes you. Sometimes it makes you find every traffic light in Ohio. Here's what's going on.
It's not the click
The checkbox (Google's reCAPTCHA is the best known) is mostly checking what happened before you clicked: how your mouse or finger moved, how the page was used, and what your browser and connection look like. A smooth human-looking history gets a tick straight away. Anything unusual gets a puzzle.
Why you keep getting puzzles
- A VPN or a shared network (office, school, mobile carrier) that lots of people use.
- Privacy settings or extensions that clear cookies or block scripts.
- Doing something many times quickly: searches, sign-ups, refreshes.
- A new or unusual browser.
What AI did to CAPTCHAs
Image puzzles worked because computers couldn't recognise traffic lights and buses. Now they can, very well. So modern checks rely more on behaviour and less on the puzzle, and many sites now check invisibly in the background without showing anything at all.
The opposite test
A CAPTCHA is a machine trying to tell if you're a person. Who Is a Bot? flips it: you're the one trying to tell if it's a person.
Play the human-side CAPTCHA →
Questions
What does CAPTCHA stand for?
"Completely Automated Public Turing test to tell Computers and Humans Apart". It is a Turing test run by a machine.
Why did I fail a CAPTCHA when I clicked everything right?
The puzzle is only part of it. The background checks may still have looked unusual, for example because of a VPN.