What is a CAPTCHA challenge? Types, accessibility and privacy

02How does a CAPTCHA challenge and response work?

Most CAPTCHAs follow the same token lifecycle, whether they are third-party or self-hosted. The step that actually protects the form happens on the website's server, not in the puzzle.

• The page loads the widget or a challenge page, tied to the site by a public site key
• The visitor solves the task, or the browser passes a background check, and the widget issues a response token
• The form submits that token with its other fields
• The server sends the token and its secret key to the provider's verification endpoint, or checks it locally if self-hosted
• The result states whether the token is valid, when it was issued and for which hostname; only then is the request accepted

POST https://www.google.com/recaptcha/api/siteverify
secret=YOUR_SECRET_KEY&response=TOKEN_FROM_THE_FORM

{
  "success": true,
  "challenge_ts": "2026-10-25T09:14:02Z",
  "hostname": "example.com"
}

03What types of CAPTCHA are there?

Eight families cover almost everything in use. Human solve times come from two large studies: Bursztein and colleagues measured more than 318,000 CAPTCHAs in 2010, and Searles and colleagues had 1,400 participants solve 14,000 deployed CAPTCHAs for a 2023 USENIX Security paper. The bot column shows published attacks, most of them compiled by the 2023 paper for comparison.

04Are CAPTCHAs accessible? What WCAG 2.2 requires

Mostly not, and WCAG 2.2 says so. Success criterion 3.3.8, Accessible Authentication (Minimum), at level AA, forbids a cognitive function test in any login step unless another method or a helping mechanism exists, or the test only asks the user to recognise objects or content they supplied. WCAG counts transcription, calculations and puzzles as cognitive function tests.

So a text or math CAPTCHA on a login fails level AA without another way in, such as a passkey, while object-recognition grids pass at AA but not at AAA under criterion 3.3.9. The W3C's Understanding document adds that an audio version still requiring transcription is no alternative, and that the rule applies even when the CAPTCHA appears only after failed logins. Criterion 1.1.1 applies everywhere, contact forms included: it asks for a text alternative describing the CAPTCHA's purpose and a version for a different sense.

• Give every login a path without a puzzle: passkeys, an emailed sign-in link or a support contact
• Show a CAPTCHA only when risk is raised, and offer a different kind of challenge on request
• Test the whole flow with a screen reader and with the keyboard alone

05What data does a CAPTCHA collect?

Checkbox and invisible CAPTCHAs judge the browser more than the answer. The W3C note lists what the reCAPTCHA checkbox collects, including the browser language, Google cookies from the previous six months, clicks or touches, installed plugins and JavaScript objects, and the 2024 ETH Zurich study found that reCAPTCHA v2 relies heavily on cookie and browser history data. Any third-party CAPTCHA sends visitor data to its provider, which for EU audiences belongs in a privacy review; self-hosted ones keep it on the site's own servers.

Privacy Pass, standardised by the IETF in June 2024 as RFCs 9576 to 9578, lets a client show that it passed an issuer's check without revealing who it is. As OWASP's cheat sheet notes, a valid token shows that the client met the issuer's policy, not that a human is present.

06Can bots and AI solve CAPTCHAs?

Yes, most of them, usually faster and more accurately than people. Searles and colleagues found that published bots were more accurate than people on every type they could compare, at 85 to 100% and mostly above 96%, and faster on all of them except reCAPTCHA image challenges, where bots and people took similar time. Where software falls short, people fill in: OWASP notes that visible CAPTCHAs are outsourced to human solving farms for fractions of a cent per solve, and calls them a last-resort step-up rather than a primary defence.

07Why am I being asked to complete a CAPTCHA?

Because something about the visit made the site less sure, or because it is challenging everyone during an attack. Typical triggers are a shared address (a VPN, a mobile network or a company proxy), many requests in a short time, blocked cookies or scripts, and failed logins; the W3C notes that some CAPTCHAs appear only when ad blockers are present.

08Which CAPTCHA should a site use?

Usually the least intrusive check that stops the traffic actually seen, shown to as few visitors as possible: rate limits and hidden honeypot fields first, a background challenge where automation persists, and an interactive puzzle only for clients that failed the lighter steps, with an accessible path around it. These guides cover each step.