What is an invisible CAPTCHA?

The visible CAPTCHA, a distorted word or a grid of photos, puts the cost of spam on the person filling in the form. Some people pay it and some leave. For people who cannot see the images or hear the audio version, it can be a locked door: the W3C has written about how these tests exclude many people with disabilities.

An invisible CAPTCHA moves the check out of the visitor's way. How it does that is where the three kinds part.

The script watches the visit and sends what it observes to the vendor, which returns a score. Google's reCAPTCHA v3 is the best-known example. Its documentation says it returns a score between 0 and 1, higher for an interaction that looks good and lower for one that looks like a bot, that it never interrupts the user, and that a threshold of 0.5 can be used by default.

The score is only advice. Your server decides what to do with a low one: refuse the form, ask for something more, or let it through. A real person on a privacy-focused browser or a shared network can score low, and neither you nor they will see why.

The script runs checks in the browser and decides on the spot, showing a puzzle only when it is unsure. Cloudflare Turnstile works this way. Its documentation describes three widget modes: managed, which shows a widget and asks the visitor to select a box only when a further check is needed; non-interactive, which shows a widget with a loading spinner but never asks for anything; and invisible, which shows nothing at all.

Older invisible reCAPTCHA follows a similar pattern: it runs when the visitor presses a button, and can still put a challenge in front of traffic it finds suspicious. So invisible here means invisible most of the time, for most people.

The browser does a small computation and sends the solution with the form. Nothing is judged and nothing is shown. Every visitor does the same work, and so does every bot, on every submission.

Botpoison Challenge is this kind. The check runs when the visitor presses Send. There is no visible fallback, because there is no judgement to be unsure about. The proof-of-work explainer covers how it works and its limits.

Removing the puzzle removes the biggest barrier, but invisible is not the same as accessible. Three questions are worth asking of any invisible check:

• Can it fall back to a visible puzzle? If it can, the people most likely to see it are the ones whose browsers look unusual, which includes many people using assistive technology.
• What happens to a low score? A silent refusal is the hardest failure to report, because the visitor is not told anything.
• What happens when the script cannot run? Every invisible check needs JavaScript. With Challenge, a browser that cannot run the check fires an error event, so the page can say what happened and offer another way to get in touch.

A check you cannot see still collects something. A risk score works by observing the browser and the visit, and that observation is what European regulators have looked at; see reCAPTCHA and the GDPR.

Challenge sets no cookies, stores nothing in the browser and builds no profile of the visitor. Like any server, it does record details of each check, such as the address it came from, for the site it protects.

All three kinds ask whether a person is there. None of them reads the message. So none of them stops the SEO pitches and scams that people type into forms themselves; see why spam gets past your CAPTCHA. For that, a content classifier such as Classify reads the submission on your server and answers spam or clean.

Challenge and Classify are on one plan, each with a free allowance. See pricing.

• reCAPTCHA v3 Google for Developers
• Turnstile widget modes Cloudflare Docs
• Inaccessibility of CAPTCHA W3C