Learn: how CAPTCHAs work, who makes them, and how AI agents fare
A guided course through CAPTCHAs: the check behind the box, the history, every major vendor and open option, AI agents, costs, what still works.
Facts on this page checked 2026-11-01
This section explains human checks on the web from the ground up. It is written for anyone technical enough to read a network log, and it assumes no prior knowledge of CAPTCHAs. Every fact carries the date we checked it and a link to its source. We cite papers and vendor documentation, not marketing.
Suggested reading order
| If you want to… | Read |
|---|---|
| Understand what a CAPTCHA actually does | What happens when you tick the box, then the history |
| Compare products | Every major vendor and open-source and self-hosted options |
| Know whether CAPTCHAs still stop AI | How AI agents fare (2024–2026), then the economics |
| See where the field is going | What still works: cost, scarcity, accountability |
| Protect yourself or your users | Is this CAPTCHA real?, a plain guide to fake CAPTCHA scams |
| Look up a term | The glossary |
Read straight through, the core pages take about an hour.
Where to go after this
- To choose a CAPTCHA for your own site, use the Defend section. Accessibility rules are covered in CAPTCHAs and accessibility.
- To see the invisible score your own browser gets, use Browser score.
- If you build agents and want the legitimate way through, read Build.
- For the full paper list and the standards work, see Research.
- To see real widgets give real verdicts, open our live measurement page.
Pages in Learn: how CAPTCHAs work, who makes them, and how AI agents fare
- What happens when you tick the box
The full path of a CAPTCHA check: the widget, the signals it collects, the risk score, the optional puzzle, the token and the site's server check. - A short history of CAPTCHAs
From distorted text in 2000 to invisible scores, proof of work, anonymous tokens and signed agents: a dated timeline with sources. - Every major CAPTCHA and bot-defence vendor, and how each works
What each vendor shows visitors, what it checks, what the site receives and who can sign up: reCAPTCHA, hCaptcha, Turnstile, Arkose, DataDome and more. - Open-source and self-hosted CAPTCHAs
ALTCHA, Cap, Anubis, mCaptcha, Procaptcha, go-captcha, PrivateCaptcha, honeypots and tarpits: how each works, its licence, and what it does not stop. - How AI agents fare against CAPTCHAs (2024–2026)
What the published research measured: puzzle designs that fall within months, real-widget results, how agents get detected, and the theoretical ceiling. - The economics: what a CAPTCHA solve costs
Prices and speeds of human solving farms and token services, model-based solve costs from papers, users' lost time, and why cost is the real test. - What still works: cost, scarcity, accountability
Once agents see as well as people, three levers remain: making abuse cost more, asking for scarce credentials, and making agents say who they are. - Is this CAPTCHA real? How to spot a fake one
Fake CAPTCHAs that tell you to press keys and paste a command are a common way to install malware. How the scam works, how to spot it, what to do. - Glossary
Short definitions of the terms used across CAPTCHArena, from ACT and attestation to Web Bot Auth, each with its own link anchor.