What is a CAPTCHA and why are they getting harder?
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a challenge designed to be easy for people and difficult for software.
Why they are getting harder is straightforward and slightly uncomfortable: machines got better at them than humans.
Optical character recognition surpassed human accuracy on distorted text years ago, which is why text CAPTCHAs became progressively more mangled until they were failing legitimate users, and were then largely abandoned. Image recognition then matched and exceeded human performance on object identification, undermining the "select all the traffic lights" generation. Each defence was defeated, and the response was to make the challenge harder — until the challenge is now frequently harder for people than for the bots it targets.
How modern systems actually work. The visible puzzle is increasingly not the real test. Systems such as reCAPTCHA v3 and similar services score requests invisibly, based on:
Mouse movement and timing — human cursor paths are irregular in characteristic ways.
Typing cadence, scroll behaviour and interaction patterns.
Browser and device fingerprinting, including inconsistencies suggesting automation.
IP reputation and the history associated with it.
Cookies and prior browsing, including whether you are signed in to the provider's other services.
The checkbox is largely theatre; the decision is usually made before you click it. You are shown a puzzle only when the score is ambiguous.
Why you get harder challenges than other people. Using a VPN, a privacy-focused browser, blocking cookies, a shared or datacentre IP address, or an unusual configuration all lower your score — so the more privacy measures you use, the more CAPTCHAs you face.
The accessibility problem is serious. Visual challenges exclude blind users, audio alternatives are frequently worse, and both are difficult for people with cognitive or motor impairments.
Alternatives include cryptographic attestation and proof-of-work challenges.