Bridge WAF
CAPTCHA alternatives: stopping bots without testing people
Every CAPTCHA asks real people to prove something, and some of them cannot. CAPTCHA alternatives move the check away from the person: to the browser, to the form, to the rate of attempts, or to what is submitted. None is perfect, but several together often stop as much automation as a puzzle while costing visitors nothing at all.
Quick facts
- Why look for alternatives
- Visual and audio tests exclude people; the W3C documents who
- Main alternatives
- JavaScript challenge, proof of work, honeypot field, rate limits, verification by email or phone, risk scoring
- What they share
- They ask the visitor nothing, or ask only when other signals point to automation
- What none of them prove
- That the visitor is a person; they make automation more expensive
- Best results
- Several cheap checks combined, each tuned to the action it protects
What a CAPTCHA is and its forms are on CAPTCHA and types of CAPTCHA.
CAPTCHA alternatives compared
| Alternative | How it works | Stops | Costs real people |
|---|---|---|---|
| JavaScript challenge | The browser must run a script and return the result | Simple scripts that do not run JavaScript | Visitors with scripts disabled; a short delay |
| Proof of work | The browser solves a small computing puzzle | Automation at scale, by making each attempt cost CPU | Battery and time on slow devices |
| Honeypot field | A hidden field only bots fill in | Bots that fill every field | Nothing, if hidden from screen readers too |
| Rate limits | Attempts per account, address or session are capped | Brute force, stuffing and spam at volume | Shared networks, if limits are tight |
| Email or phone verification | A link or code must be received | Mass sign-ups with fake contact details | A step and a wait; no access without the channel |
| Risk scoring | Signals are scored and only risky visits are checked | Depends on the signals | Unexplained refusals for unusual setups |
The right column is what to weigh. An alternative that stops slightly less automation but excludes nobody is often the better choice.
JavaScript challenges
A JavaScript challenge sends the browser a small script whose result must come back before the page or action proceeds. Real browsers do it in the background; scripts that only send HTTP requests fail.
Automation built on full browsers passes it, so it removes the cheapest bots, not the determined ones. It also fails for people who block scripts, which should lead to an alternative path, not a dead end.
Proof of work and honeypots
Proof of work asks the browser to find a value with a property that takes measurable computing time to find and almost none to check. One attempt costs a fraction of a second; a million attempts cost real money. It is invisible to people, though slower on old phones.
A honeypot is a form field hidden from people. Bots that fill every field reveal themselves. It costs nothing and stops only naive bots, which on many sites are most of the spam; see spam bots.
Choosing the best CAPTCHA alternative
- Name the threat for each form. Sign-up spam, credential stuffing and carding need different checks; the OWASP Automated Threats list helps name them.
- Start with what asks nothing. Honeypot fields and rate limits on the action.
- Add a browser check where needed. A JavaScript challenge or proof of work for actions worth automating.
- Keep a human-friendly fallback. Email verification or support contact, never a dead end.
- Measure both sides. Automation stopped, and real people who gave up.
Questions
What are alternatives to CAPTCHA?
JavaScript challenges, proof of work, honeypot fields, rate limits, email or phone verification, and risk scoring that checks only suspicious visits.
What is a JavaScript challenge?
A JavaScript challenge requires the browser to run a script and return its result before continuing, which stops simple bots that do not execute JavaScript.
What is the best CAPTCHA alternative?
There is no single best one. Combining a honeypot field and rate limits on the action, with a browser check for valuable actions, stops most automation without asking people anything.