What is a CAPTCHA? How it works and which types exist
Updated:
Quick answer
A CAPTCHA is a check on a website that tells automated programs (bots) apart from human visitors, usually before a form is submitted. Types range from image puzzles to invisible risk scoring and proof-of-work, where the visitor’s browser solves a small calculation. Pick one by how much friction it adds, whether it needs cookies, where data is processed and how accessible it is.
What does CAPTCHA stand for?
CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart”. The idea is simple: give the visitor a task that is easy for a person but hard for a script, and only let the request through if it is solved.
Websites use CAPTCHAs on sign-up, login, contact, comment and checkout forms, wherever automated submissions cause spam, fake accounts or credential-stuffing attacks.
The main types of CAPTCHA
| Type | How it works | Trade-off |
|---|---|---|
| Text or image puzzle | The visitor reads distorted text or picks pictures that match a label. | Clear signal, but adds friction and can exclude people who use assistive technology. |
| Checkbox with risk analysis | A click on “I am not a robot” plus behaviour and device signals decide the result. | Less friction, but the signals can involve data collection that needs a legal assessment. |
| Invisible score | No interaction. A backend assigns a score and your server decides what to do. | No friction for visitors, but someone has to choose and tune score thresholds. |
| Proof-of-work | The browser solves a small calculation in the background; harder for suspicious requests. | No puzzle and no stored identifier, but it is not a standalone defence against every attack. |
| Honeypot field | A hidden form field that humans never fill in but simple bots do. | Free and invisible, but easy for targeted bots to skip. |
How to choose a CAPTCHA for your website
- Decide what you protect. A newsletter sign-up needs less than a login or payment form.
- Check friction. Every extra step costs sign-ups, so prefer checks visitors do not notice.
- Check privacy. Does the widget set cookies or read data from the device? Where is the data processed and is a data processing agreement available?
- Check accessibility. Try the demo with the keyboard only and with a screen reader.
- Check migration effort. If you already use reCAPTCHA, a provider that answers in the same response format saves development time.
Where BurgCaptcha fits
BurgCaptcha uses proof-of-work in the browser plus request risk signals. Visitors see no puzzle, the widget sets no cookies and hosting is in the EU on every plan.
There is a free plan for up to 1,000 requests a month, commercial sites included.
Frequently asked questions
What is a CAPTCHA in simple terms?
A small test on a website that checks whether the visitor is a person or a program, so that bots cannot flood your forms with spam or fake sign-ups.
Does a CAPTCHA stop all bots?
No single check does. A CAPTCHA raises the cost of automated abuse and blocks most simple bots. Combine it with rate limiting and server-side validation for sensitive forms.
Do I need a CAPTCHA on every form?
Not necessarily. Put it on forms that attract abuse, such as sign-up, login, password reset, contact and comment forms, and keep low-risk pages free of it.
Is a CAPTCHA the same as reCAPTCHA?
No. reCAPTCHA is one product, operated by Google. CAPTCHA is the general term for the technique, and there are many alternatives.