What is a CAPTCHA, and why are they getting so hard?

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart, and its purpose is to block automated abuse: bots creating fake accounts, scraping content, posting spam, buying up limited inventory, or testing stolen passwords. Early versions showed distorted text that optical character recognition could not read. As image recognition improved, the tests shifted to identifying objects in photos, and the labeling work users did was famously repurposed to train the very systems that would eventually solve it.

The arms race is the reason the puzzles became frustrating. AI now solves image CAPTCHAs more accurately and faster than people do, so a puzzle hard enough to stop a bot is also hard enough to stop a meaningful share of humans, particularly those with visual or cognitive disabilities, for whom these tests have long been an accessibility barrier. Human CAPTCHA-solving services also exist, paying workers fractions of a cent per solve, which undercuts the premise entirely.

The response has been to move the test out of view. Modern systems score you continuously on signals such as mouse movement, typing rhythm, browsing history, device characteristics, and reputation, and only present a puzzle when the score is ambiguous, which is why you often just check a box or see nothing at all. Newer approaches issue cryptographic proofs that your device or browser is legitimate without revealing identity. Seeing a lot of CAPTCHAs typically means something about your setup looks suspicious: a VPN or shared IP address, an aggressive privacy configuration, a fresh browser with no history, or a network with bot traffic, and none of that is evidence you did anything wrong.