Captcha test

Whether each captcha lets this browser through, how long it took and whether it asked for a click. A result counts only after the provider confirmed the token on our server, which is the same check a real site makes.

Turnstile first runs small challenges in the background that read signals from the browser. It shows a checkbox only when those leave doubt, so passing without a click means the background checks were enough.

Turnstile managed shows a checkbox only when Cloudflare is unsure, non-interactive shows the widget but never asks for a click, and invisible shows nothing. reCAPTCHA v2 is either the classic checkbox or an invisible check that brings up a picture task when Google is unsure, and v3 never shows anything and returns a score. hCaptcha works like reCAPTCHA v2, as a checkbox or an invisible check. MTCaptcha shows distorted characters to type. The site that embeds the captcha chooses the mode.

Google scores against the traffic a key has already seen, and a new key without that history gives almost every browser the same 0.9: in our own measurement nine runs out of nine did, with and without any mouse movement. The score only starts to mean something on a key with real traffic behind it.

That depends on the signals the captcha reads, not on the click itself. The AI agent check shows which signals give an automated browser away.