Sign up ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm working on setting up a CAPTCHA on a project, and just thought about the user experience of it. I personally find them tedious, especially if they're too difficult.

enter image description here

Even these are pretty easy compared to most you see now a days, but look at the mess!

I stumbled upon a question from 2010, and it had an interesting answer regarding human verification methods.

The most effective solution I've ever encountered for differentiating between robots and people is to be aware of whether or not they have spent money on the internet.

To use an email as a common account identifier for this example. If you know that email has ever purchased any item online, whether it be from you, a competitor, amazon or any digital marketplace, you can be 100% certain they are a human, and not a spam bot.

This works today, and will never stop working because the cost of purchasing an item will always exceed the value of the spam that can be posted afterwards, making spam no longer economically feasible.

This is not very doable for many people who don't operate in e-commerce or related industries, but in situations where you do have that data, you have a flawless way to identify if a person is human. No more prompting them with tricky questions.

Quoted from Can we do better than CAPTCHA?

Now, obviously this would be difficult to do without the other sites having a list of way to cross check e-mails and see if they've ever purchased anything. Then you also have the dilemma of what happens if they didn't purchase anything but they are really a human.

Is cross checking e-mails against sites that list spam bots effective? If you're not on there, no CAPTCHA, and if you are, then you get a very difficult CAPTCHA that you need to pass. This again though leads to problems where new spam bots come in and can go on your site since they're not yet blacklisted.

The short (tl;dr) version of my question: Is there a more user friendly way to check if a user is human?

share|improve this question
I remember I saw a captcha a while ago where you would drag parts to make a cheeseburger. It's a good idea because it requires common sense (boot does not go on cheeseburger, bread does, etc). I'll try to find it. There's also this – Frankie Jan 12 '14 at 23:45
Putting the (tl;dr) version of the question at the end seems likely not to be effective. Those who didn't read to the end won't see it. But good question. – Ross Millikan Jan 13 '14 at 4:26
@chipperyman573 that cheeseburger example is not really a more user-friendly version. If I am a keyboard user, or am partially sighted then I can't use that version at all. At least Captcha is keyboard accessible. – JonW Jan 13 '14 at 13:28
@Ross Millikan - I just put the tl;dr there so that if people got to the end and forgot what I was asking, the question was there. It's more of a summary of my post rather than a tl;dr, I just named it as such. – Mike Jan 13 '14 at 14:44
@Mike then maybe consider non-CAPTCHA solutions such as email confirmation perhaps. – DA01 Jan 13 '14 at 23:55

10 Answers 10

up vote 41 down vote accepted

CAPTCHA is an example of forcing a customer to deal with a business/technical problem - an exchange of great effort for little return on their behalf. "Are you human?" often accompanies these all too common patterns.

You can do better than CAPTCHA by not questioning your customers' humanity, and instead build honey-pots to catch the bots. Honey-pots are hidden fields buried within the form that bots will 'read'. For example, a hidden check-box or input which when selected or filled-out rejects the form submission.

There is a few other technicalities to consider - i.e. method of hiding fields, randomising field names, dealing with your captive bots etc. - but reading a few good articles on the design of the honey-pot can help, for example

share|improve this answer
More and more "bots" nowadays are regular web browsers (just without a window). Honeypots do nothing to stop them because they are indistinguishable from a regular user in terms browsing behavior. – Blender Feb 15 '14 at 11:07
Not only that, but what about specific targeted attacks. The above suggestion may work for bots sweeping the internet and trying to find vulnerabile forms. But if your site is specifically being targeted for eg mass-registration. Honey-pots do nothing to stop the attacker just scripting around it. – Josh Mc May 30 '14 at 2:10
I would note that if the user fails the honey pot , make your user go through a disability friendly Captcha like reCaptcha since screen readers are most likely to fill in honeypots. This can stop you from being liable for not being disability friendly. – GiantCowFilms Oct 18 '14 at 22:20
@JoshMc - Having never experienced such an attack, this is probably a naieve question, but in the case of a targeted attack, wouldn't you be better off finding and blocking the source? If they are willing to analyze and customize an attack just for you, I don't see any code trickery being able to thwart the attacker for long. – T.E.D. Jun 1 at 14:17

You can add a hidden field -- that is hidden to the UI, but not the code. The Spam-bots will fill out that field, while real people will not.

It solves the spam problem without annoying real people.

See Spamicide for example

share|improve this answer
Dude, anyone can tell a robot to skip that field. They do make programs to attack specific sites. Also, a robot too can tell if a field is hidden from UI. – BlueFlame Jan 13 '14 at 14:55
In pseudo code: if input type == hidden then skip – Code Maverick Jan 13 '14 at 16:38
@BlueFlame anyone can create a robot to circumvent nearly any CAPTCHA if they want. It's all a game of pragmatic balance. – DA01 Jan 13 '14 at 17:08
@DA01 That is not true even in the slightest. That's like saying anyone can pick any lock if they want. It's true only from the perspective of a novice who only buys bad locks. With a little bit of research you can find locks that have never been picked, or settle with one that is prohibitively expensive to pick. Same goes with Captchas. – VoronoiPotato Jan 13 '14 at 22:18
@VoronoiPotato anyone CAN pick any lock if they want to. If there's a reason to circumvent a CAPTCHA, people will do it. If not via bot, via stupendously cheap human outsourcing. – DA01 Jan 13 '14 at 23:54

I absolutely hate 'text' orientated/based captcha's, they are inconvenient, often too difficult, annoying, time consuming etc etc.

There are hundreds of alternatives though that don't make the user have to attempt at getting every letter of a ridiculously difficult captcha correct before being able to complete the what should have been a 2 second task.

Even if you show 4 pictures of a dog and 1 picture of a cat and use the question 'please click on the cat' below.

Here are some alternatives to captcha and this method uses javascript to recognise human activity on screen events.

share|improve this answer
These are brilliant and take advantage of things humans are very good at and computers are very bad at. – VoronoiPotato Jan 13 '14 at 22:23

What about using some kind of proof-of-work concept?

In the case of a web-site, you implement some proof-of-work generator in javascript, performing what will amount to e.g. 100ms of work on an average workstation and submitting that to the webserver. Not too long to wait to submit a form, and a lot less work than entering a captcha anyway.

share|improve this answer
Very interesting, would slow any single source spam engine but largely ineffective with botnets. – VoronoiPotato Jan 13 '14 at 22:24
+1: I was just thinking the same. You could make it 500 ms even without much trouble, making it for even more spam bots a lot harder. – Virtlink Jan 14 '14 at 2:55
Really interesting idea. It changes the question from "is the user human" to "is the agent a real browser". I wonder if it's viable long-term though - supercomputers /botnets have a lot of power. – Steve Bennett Jan 14 '14 at 23:49
One potential drawback. For mobile users, you're asking their processor to do a lot of work, and cpu cycles are a battery killer, so this should at least be used sparingly. – user3550 Feb 4 '14 at 3:53

As far as I know, there is no "ideal" solution to replace captchas. Whether math questions, or simple tasks as drag&drop or sliding a cursor, etc. do not stand much to hackers.

There exist other alternatives, of course, like :

  • Asking simple questions but time required to read and comprehend these questions may vary because these are unusual and unknown to users + they are still breakable + Need for thousands of questions in database to be safe + need for translation of all questions in user’s language

  • Using 3rd party authentication such as social logins (Facebook & the like) but not all people DO use social networks

  • Solve media: company using ad hybrid captcha requiring the user to answer simple question about the company’s ad (eg. "Please write down the text that is written below the company logo")

  • User time expenditure (Timestamp analysis): identifying users or bots by measuring time taken to submit form. (eg.: if less than 5 secs = bot for instance)

As a conclusion, the best alternative I'm aware of up to now is:

  • Either a MIX of several methods as honeypot AND user time expenditure (still not fullproof)

  • OR Re-captcha (Google's Re-captcha): because it is the easiest/safest of all captchas up to now (still issues for disabled as blind people for instance as audio alternative not user-friendly at all)

I'd recommend you to use Re-captcha.

share|improve this answer

The best alternative to Captcha I've ever seen are custom interactive controls.

A control that tells you something like :

Please drag the the ball to the end of the line 


And then you have to take the little ball and drag it till the end of the line. It is fun, surprising for users, very very quick and also bot proof.

share|improve this answer
But can I use that with a keyboard? The trouble with all these 'fun' alternatives is that they're worse for accessibility, so you're actually locking a significant number of people out of accessing that functionalty. – JonW Jan 13 '14 at 23:11
That's a good point, JonW--for most sites. If you don't care about people who don't use mice, though, this solution is great. I know many devs would say "but websites must support ALL users", and again, for many sites that's true. But sometimes not--e.g., I have a web app where users can pan/zoom/scale a world map and place markers on it. The entire point of app is being able to interact with the map; it's very visual. So in my case, I don't care about users who don't use mice. They're not my target audience, and I think that's fine. Not every site has to accommodate absolutely everyone. – sgroves Jan 16 '14 at 22:22
@sogroves - not every site has to accommodate everyone. True. But every site should NOT exclude anyone either. If we follow that path, we will have a lot of exclusions - and that's the main issue I believe. :) – MEM Apr 19 '14 at 12:31

You could use the service.

It's randomly chooses a game from a list of a few really basic games like a net and capturing the butterfly.

It requires human thinking to disguish items from one another and has medium success rates because the game might occasionally bug out but other than that a good captcha like service.

share|improve this answer
What is this? How does it work? Why is this good? Is it accessible? Does it have high success rates? Just adding a link with no explanation or reasoning isn't really a helpful answer, it's just a link. – JonW Jan 14 '14 at 9:16
Edited, can you remove downvote please? – BigBrother Jan 14 '14 at 10:08
It's not my downvote to remove. But anyway I'm still not convinced that it's an easier and more user friendly alternative, it's just an alternative. I don't see why this is better than CAPTCHA. – JonW Jan 14 '14 at 10:46
This basically is a CAPTCHA. It still also makes the user do work which is what I'm trying to avoid. – Mike Jan 14 '14 at 13:40

There are web server solutions to part of the problem. If you're trying to prevent DOS attacks, for example, IIS, as an example, has a plug-in called "Dynamic IP Restrictions". This plug in allows you to tell IIS to Deny IP addresses based on a configurable number of concurrent requests and/or a configurable number of requests over a specified time period. I'm sure other web servers have similar mechanisms.

This won't stop one-time spam requests but, combined with a honey-pot, you can eliminate the need for a CAPTCHA altogether.

share|improve this answer

Require some base intelligence beyond symbol recognition.

  1. Ask the user to add two single digit numbers, possibly from a mix of letters and numbers.
    Example: "hp5mcer6pnt"
    Answer: "11"

  2. Ask the user to enter the numbers ignoring the letters.
    Example: "hp5mcer6pnt"
    Answer: "56"

  3. Ask the user to enter the third and fifth characters. Different random positions each time.
    Example: "MEOGSYFPNE"
    Answer: "OS"

Here is an example I ran across today, really nice to use:

share|improve this answer
Yeah, but that goes against usability principal #1: Don't Make Me Think. – JonW Jan 13 '14 at 23:10
To be clear, all security makes things harder for the user. Also, trying to figure out a graphic CAPTCHA makes me have to think so hard my head hurts. Some are so hard I have to try several to get one I can read. – zaph Jan 13 '14 at 23:48
In addition to 'Don't make me think' this introduces accessibility challenges for those with cognitive disabilities. Granted, that's perhaps true with a CAPTCHA as well. – DA01 Jan 13 '14 at 23:56
These all fail because the actual task is much easier for a computer than a human. The only part of a task that's easier for the human is understanding the question and submitting the answer, so you might as well make the question trivial: "Please enter 'hello' in this box:" or maybe "What's the opposite of black?" – Steve Bennett Jan 14 '14 at 23:51

If a user fills a form you can capture all keystrokes that the user makes and also capture mouse movements. You would have to forbid regular users from using software that automatically fills forms but that might be a price you are willing to pay.

You could run that data through pattern recognition algorithms and catch a good portion of spammers.

share|improve this answer
Ideally I wouldn't have to block out any users. – Mike Jan 17 '14 at 16:09
@Mike: Telling a user who normally uses automatic form filling software to fill the form manually isn't blocking them out. It's just increasing their workload. – Christian Jan 17 '14 at 16:25
That's not really much different to CAPTCHA though. It's basically saying to users "We have a problem with spammers, but we can't deal with it so we're just going to make it more inconvenient for genuine users to fill in these forms instead". – JonW Jan 17 '14 at 16:27
@JonW: There no way to allow genuine users to automatically fill forms and not allow nongenuine users to automatically fill forms. – Christian Jan 17 '14 at 16:34
@Christian: Very true, but you're still penalizing genuine users with your method because - for whatever reason - you can't / don't want to cope with some spam / undesired users. The end user doesn't care that you get spammed, they just care if they can complete their transaction. If they can't complete their transaction then you have failed. No, there isn't a perfect system, but even no CAPTCHA allows anyone who is genuine to complete their transaction. – JonW Jan 17 '14 at 16:43

protected by JonW Jan 15 '14 at 15:27

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.