The landscape of bot detection is being mapped in a new open-source project that catalogs 39 distinct types of CAPTCHA systems. By documenting identification signals and both free and paid bypass methods, the project aims to provide a centralized, maintainable reference for researchers and developers to understand the trade-offs of various anti-bot protections.

A promotional graphic for the FuckCaptcha project titled 'the field guide to 39 CAPTCHA types'.
The FuckCaptcha project provides a comprehensive field guide to 39 different types of CAPTCHA systems.github.com

This image serves as the primary visual for the project, illustrating the scope of the 39 CAPTCHA types cataloged in the repository.

A visual representation of the reCAPTCHA Enterprise system.
One of the enterprise-grade systems included in the project's catalog is reCAPTCHA Enterprise.github.com

The article mentions reCAPTCHA as a key system covered by the guide's documentation.

A visual representation of the Cloudflare Turnstile system.
Cloudflare Turnstile is another major anti-bot system documented in the open-source repository.github.com

Cloudflare Turnstile is explicitly listed as one of the systems covered in the guide's spectrum.

Categorizing the CAPTCHA Ecosystem

The project organizes a diverse array of CAPTCHA families into a searchable interactive guide. It covers well-known consumer-facing systems like reCAPTCHA and hCaptcha alongside specialized enterprise solutions such as DataDome, Arkose Labs, and Amazon WAF.

A visual representation of the Arkose Labs CAPTCHA system.
Arkose Labs is included among the specialized enterprise solutions analyzed by the project.github.com

Arkose Labs is highlighted as a specialized enterprise solution within the project's searchable guide.

A visual representation of the Amazon WAF CAPTCHA system.
The guide also includes documentation for Amazon WAF's bot detection mechanisms.github.com

Amazon WAF is listed as one of the enterprise solutions the project organizes into its interactive guide.

By grouping these systems, the guide allows users to compare how different providers approach bot detection. This includes identifying the specific signals a system uses to challenge a user and the context in which those challenges typically appear.

“Bring a changing landscape of CAPTCHA systems into one approachable, maintained reference.”

— GitHub - vsmutok/FuckCaptcha: Open field guide to 39 CAPTCHA types: identification signals, free and open-source bypass

Analysis of Bypass Methods and Trade-offs

For each CAPTCHA type, the guide documents various documented approaches for bypassing the challenge. These include both free, open-source tools and paid alternatives, allowing researchers to evaluate the practical limitations and trade-offs of different methods.

Project Scope and Reach: CAPTCHA types documented 39; GitHub stars 61
Project Scope and Reachgithub.com

Chart drawn by HN Digest from figures reported by github.com; values are shown as written in the source.

The documentation emphasizes the distinction between different solver types. It provides a directory of documented options to help users understand which tools are currently associated with specific CAPTCHA families and what their known limitations are.

Difficulty Scaling and Research Intent

To help navigate the complexity of the various systems, the project employs an editorial difficulty scale. Labels range from 1 (Low) to 5 (Very high), providing an estimate of the difficulty involved in navigating or solving a specific challenge type.

The project explicitly states that its goal is to make the material easier to navigate, compare, and cite for authorized research. It prioritizes transparency in sourcing and responsible use, urging researchers to respect applicable laws and the terms of service of the systems being studied.

What Hacker News readers are saying

  • Technical note: One commenter explained that reCaptcha v3 is not a visible puzzle for users to solve, but rather a system based on behavioral profiling. comment ↗
  • Skeptical: Another user expressed concern that providing a comprehensive repository of CAPTCHA types could be easily exploited by bots and spammers. comment ↗
  • Skeptical: A commenter suggested that the content of the repository appeared to be generated by an LLM, implying that automated agents might already be familiar with the information. comment ↗

Summarized opinions from the Hacker News thread, not verified facts. Read the full discussion ↗