CAPTCHAs, Who Needs 'Em?
One of the worst CAPTCHAs is the one where you have to select the squares with traffic lights or motorcycles or steps. There’s a tiny piece of the traffic light in one square, and you’re not sure if the puzzle really counts that as part of the traffic light or not. So you end up doing the puzzle two or even three times to get it right, and left wondering if you are in, in fact, human.
And what we now know is that AI is actually better at solving these puzzles than we are. A 2023 UC Irvine study found bots solved distorted-text CAPTCHAs about 99.8% of the time in under a second, while humans got 50–85% right in 9–15 seconds. In 2024, an ETH Zurich model solved 100% of reCAPTCHA v2 image grids.
So what are we really trying to do?
At this point, what are we really trying to do? Are we trying to stop all bots just because they’re bots, and only allow humans? Or are we trying to stop abuse and spam? More often than not, those things can be stopped without a visual puzzle.
They have also been used to digitize analog content. There’s a reason reCAPTCHA used street imagery. These puzzle solves are used to train Google maps. Some were used to digitize books. Is this friction necessary to user experience? Likely not.
Visual puzzles kill accessibility and conversions
Visual puzzles also present accessibility issues. Yes, sometimes there’s an audio option, but it’s still not great.
Actually, they slow all users down, regardless of ability.
And it’s not just you. A 2010 Stanford study found that when three people solved the same distorted-text CAPTCHA, they all gave the same answer only about 71% of the time. With audio CAPTCHAs, they agreed just 31% of the time. Big fat fail.
Bottom line is that they frustrate people, and they add friction.
We know friction results in fewer conversions. In the MECLABS conversion heuristic, you’re basically subtracting friction to get to your predicted conversion rate. More friction, fewer conversions.
C = 4m + 3v + 2(i - f) - 2a
C = probability of conversion
m = visitor’s motivation
v = clarity of the value proposition
i = incentive to take action
f = friction
a = anxiety
A CAPTCHA adds to f (friction), and it can add to a (anxiety) too.
Is it needed? Is it worth it?
Do we even want to stop all bots?
That goes back to the question. Now that we have AI doing tasks on our behalf, do we really want to stop them?
More often than not, the CAPTCHAs on lead gen forms are there to stop spam. What we really need to focus on is security, and there are just better ways to handle spam.
Better ways to stop spam
We can do a lot of what we need without presenting a visual puzzle. For most cases, all you really need is a honeypot and a plugin, like Cloudflare Turnstile. There are also services that let you check whether an email address is real or not. We don’t usually find them necessary, though.
What about security?
Now that AI is so sophisticated, CAPTCHAs alone really don’t cut it. Sometimes we have to give up a little UX in the name of security, but I’m hopeful that CAPTCHAs will soon be one less concession we have to make!
