Solved 0 / 6 · 0.0s
The companies asking already know. They're asking anyway. You've been clicking traffic lights for thirty years for an industry that has spent the same thirty years building dossiers that already prove it. Every click was training data. The bots that broke each generation were trained on your clicks. Below, every CAPTCHA from 1997 to 2026, every widget real where it can be, with the receipt for the labor at the end.
Scroll. We start in 1997, with the question.
Generation 01 · The internet you forgot
1997
AltaVista · the first warped-text test · type the letters you can read
www.altavista.com — verify human — Netscape
_ ▢ ×
👷 UNDER CONSTRUCTION — Last updated 11 / 23 / 1997 👷
000043621
visitors since 06 / 1997 — you are visitor 43,621
Our search engine has detected significant traffic from automated softwares (so-called "bots" or "spiders"). To prevent further misuse of our URL submission system, we have added a verification step. This will not take long.
Below you will see a graphic containing letters. The letters have been distorted by computer in a way that humans can read but our software cannot. Please type the letters you see into the input box. Letters are case-insensitive.
Type the word shown below:
0.0s
★ Result ★
Your time —
Modern OCR (Tesseract) ~ 0.4 seconds
Mori & Malik (Berkeley, 2003) cracked Gimpy at 33% accuracy
Click HERE to continue once you have verified.
★ Plaque · 1997 ★
In 1997, AltaVista's search engine was being spammed by bots filing thousands of fake URL submissions. Andrei Broder's team built a test only humans could pass: distorted text on a noisy background. The patent was granted in 2001. Yahoo shipped its own version, the Gausebeck-Levchin test, in 2000–2001. Within six years, computer vision researchers were already breaking it. The arms race had begun.
★ BEST VIEWED IN NETSCAPE NAVIGATOR 3.0+ ★
© 1997 The Verifier 3000. All rights reserved. Cookies are not used because they have not been invented yet.
Generation 02 · The internet wears glossy buttons now
2007
Carnegie Mellon · Luis von Ahn ships reCAPTCHA v1
two scanned words · one is a test, one is unpaid labor
Each verification you complete helps preserve historical texts. (Or so we said.)
web 2.0 user-generated crowd-sourced ajax-powered tag soup
i
How it works: Type both words below. The first is a known control word. The second is a scanned word our software couldn't read on its own. Your guess on the second helps digitize the New York Times archive.
Type both words separated by a space. One is a test. One is being digitized.
0.0s
You just verified yourself. And worked, briefly, for free.
Your time— The control word you matched— The "discovery" word you guessed— Modern OCR + word-list model solve time~ 1.2 seconds reCAPTCHA v1 retired2018, 11 years after launch
— Plaque · 2007 —
Luis von Ahn realized 200 million CAPTCHAs were being solved every day. That's labor. He launched reCAPTCHA in 2007 to channel it: every solve digitized one scanned word from the New York Times archive or Google Books. You worked for free. Google acquired the company in September 2009 for the data pipeline. By 2014, OCR caught up and the format was retired in 2018. The work you did was used to train its replacement.
© 2007–2018 reCAPTCHA · Founded at Carnegie Mellon · Acquired by Google September 2009 · Format retired 2018
Generation 03 · The internet flattens
2014
Google · reCAPTCHA v2 · "click all the squares with traffic lights"
Waymo's classifier was hungry
When did you start training self-driving cars?
A definitive guide. According to the latest research. Every founder I know swears by #7.
G
GrindlyHQ · Following
10 min read · Apr 14, 2014
👏 4.2K 💬 312
Most knowledge workers waste 1.7 hours a day on context-switching, according to a Microsoft study nobody can find anymore. The fix isn't another app. It's a system. Below, ten hacks I actually use…
[The other nine hacks have been omitted because the actual point of this page is what comes next.]
Select all images with
traffic lights
You just labeled — traffic lights for a dataset. Self-driving programs across the industry use the same image categories. Every grid you've ever solved over the last decade fed a model that now solves these grids at 100%.
The Story · Generation 03 · 2014
Around 2014, the words went quiet and the pictures arrived.
Google had retired the two-word reCAPTCHA in stages. In its place: a checkbox that said I'm not a robot, and, if it didn't believe you, a 3×3 grid of street photographs. Click all the squares with traffic lights. Click all the squares with crosswalks. Click all the squares with buses. Stop signs. Bicycles. Fire hydrants.
If the categories sound familiar, it is because they are exactly what an autonomous vehicle's perception stack needs to recognize. The reCAPTCHA grids functioned as a labeling pipeline for self-driving research, including the Waymo program at Google's parent company. You were the annotator. Hundreds of millions of times a day. Across every site that used the widget.
In September 2024, three researchers at ETH Zürich released a paper showing they could solve reCAPTCHA v2 at 100% accuracy using YOLOv8, an open-source object detection model trained on, among other things, the same kinds of street images you spent ten years tagging. The bot that broke the test was a graduate of the school you ran.
Sources
Plesner, Vontobel, Wattenhofer — Breaking reCAPTCHAv2 (arXiv 2409.08831, 2024) · Open CaptchaWorld, NeurIPS 2025 · The widget above is real Google reCAPTCHA v2, embedded with Google's published test sitekey 6LeIxAcT…ZKhI, intended for developer demos.
PS That comment box was also our real subscribe form. Get drops like this every other week?
Generation 04 · The challenge stops asking. It starts watching.
2018
Google · reCAPTCHA v3 · invisible scoring
you do nothing · you are scored anyway
Why is Google asking when it already knows?
B Briefly
Product Pricing Customers Blog
Sign in
The Briefing · Daily newsletter
Join 50,000 founders, PMs, and engineers reading what matters tomorrow. Curated daily. Free forever.
Unsubscribe one click. By subscribing, you agree to our terms. Protected by reCAPTCHA Enterprise. No challenge will be shown.
50K+ subscribers • Trusted by Y Combinator · Stripe · Notion • SOC 2 compliant
The Story · Generation 04 · 2018
In 2018, the test became invisible. The judgment did not.
reCAPTCHA v3 launched in October 2018. There is no checkbox. No image grid. The page loads and v3 begins scoring you on a scale from 0.0 (definitely a bot) to 1.0 (definitely human). It does this using mouse movements, scroll cadence, dwell time, browser fingerprint, and your activity on every other site that ties back to the same identity graph.
A site receives your score in the background and decides what to do with you. You never see the number. You never know what threshold the site set. If you fail, sometimes you get a v2 image grid as a second chance. Sometimes you just get a generic error and never know why.
The contradiction is industry-wide. By 2018, the major platforms each had a signal-rich picture of you: account logins, device sync, browser fingerprints, location, payment history. Together, they knew you were human better than you do. They still asked the websites you visited to ask you anyway. The widget exists because the request itself is the product. Each verification is a fresh handshake confirming a surveillance graph is active on this page, on this visitor, right now. The "humanity check" is the receipt for permissions you don't remember granting.
Sources Google reCAPTCHA v3 developer documentation. Google retired the public test sitekey for v3, so the panel above is a faithful local recreation, not a real v3 token request — every signal shown is one v3 actually consumes per Google's published spec.
PS "Briefly" is a fake form for the story. But the email you typed could pull double duty — get drops like this from sheets.works every other week?
Generation 05 · The same grid wears a privacy badge
2018
Intuition Machines · hCaptcha · "rotate the image upright"
same labor, different customer
Did "privacy-first" CAPTCHAs change anything?
Free Guide · 32 pages · 2024 edition
87 frameworks, 24 templates, and the email sequences our clients used to 12× pipeline. Yours, free.
Frameworks Templates Case studies
Pipeline.io · 2024
Get the free PDF
Enter your details below. We'll send the PDF straight to your inbox.
By downloading, you agree to receive marketing emails from Pipeline.io. Unsubscribe anytime. Protected by hCaptcha.
Sent. The widget passed you instantly. In production, you might've seen the rotation puzzle…
Verify · § 4.2.a
Please rotate the image upright.
drag to rotate · within ±10° to verify
You just labeled an image's orientation for an Intuition Machines training dataset. The labor is the same as Google's image grid in 2014. The customer changed. The widget just looks different.
The Story · Generation 05 · 2018
In 2018, the same grid arrived under a new logo. The labor pipeline kept running.
hCaptcha launched in 2018 as a privacy-conscious alternative to Google's reCAPTCHA, marketed on the premise that Google was the problem. In April 2020, Cloudflare, the largest CDN on the public internet, switched its default verifier from reCAPTCHA to hCaptcha. The reason given was that Google had begun monetizing reCAPTCHA Enterprise. The reason left out was that hCaptcha pays site operators a small kickback per solve. The widget you click in 2026 might be earning the website you're on a fraction of a cent.
The format barely changed. Same 3×3 grid. Same "click all the squares with X." The image categories shifted because the customer paying for the labels shifted, from one autonomous-vehicle stack to a different roster of enterprise customers training their own image classifiers. The labor was the same. The receipt went to a different address.
By 2024, CHEQ.ai industry tests showed GPT-4V solving hCaptcha grids at roughly 80% accuracy across mixed challenges. Specialized solver services advertise 90%+ commercially. The "privacy-first" pitch was real. The "this stops bots" pitch never was.
Sources
Cloudflare on switching to hCaptcha (Apr 2020) · CHEQ: testing GPT-4V against CAPTCHA (2024) · The widget above is real hCaptcha, embedded with their public test sitekey 10000000-…0001.
PS "Pipeline.io" isn't real. But the email is. Want it pull double duty for sheets.works' actual newsletter?
Generation 06 · The challenge becomes invisible. The judgment doesn't.
2022
Cloudflare · Turnstile · September 2022 beta
September 2023 GA · this widget is real
Generation 06 · 2022
The widget below is the actual Cloudflare Turnstile, embedded with their public test sitekey. You don't have to do anything. It checks your browser. It checks your behavior. It decides.
Live · cloudflare turnstile
No challenge. No question. Just a verdict.
awaiting verdict…
private-access tokens
checking…
Plaque · 2022
Cloudflare's bet: humans don't notice friction, bots can't fake the absence of friction. Turnstile launched September 28, 2022. Most of the time it shows nothing. Your browser cooperates with the widget in the background, the widget judges, you continue. The CAPTCHA became invisible. The judgment kept happening. You no longer know when you've been verified, only that you weren't blocked.
Widget above is the actual Cloudflare Turnstile, loaded from challenges.cloudflare.com with public test sitekey 1x00000000000000000000AA (always passes). © Cloudflare, Inc. Used per their published testing documentation.
The Question · Resolved
By 2026, the bots that broke each generation of CAPTCHA have been trained on the same labels you produced. ETH Zurich solved reCAPTCHA v2 at 100% accuracy in September 2024. Industry tests in 2024 had GPT-4V solving hCaptcha at roughly 80%. Audio CAPTCHAs were broken at 85% in 2017, before Whisper even existed. The arms race never had two sides. There was always one side, and a clock.
The ritual continues because the data harvest never stopped being the point. The companies that own the verification widgets also own the surveillance graphs that make verification redundant. Cloudflare sits in front of 20% of the public internet. The major platforms hold your account logins, device sync, browser fingerprints, location history. Together, they know whether you are a human better than you do. They still ask the websites you visit to ask you, anyway. The widget is the receipt. The receipt is the product.
100%
YOLOv8 solve rate on reCAPTCHA v2 (ETH Zürich, Sept 2024)
~200M
CAPTCHAs solved per day at peak (~2014)
~10s
Average human solve time, image grid
29y
From AltaVista 1997 to today
Methodology
Every claim above traces to a primary academic paper, a product blog from Google or Cloudflare, or a citable industry benchmark. Three early myths kept out: there is no Manuel Blum 1996 paper (the term was formalized in EUROCRYPT 2003), the often-repeated "o3 solves reCAPTCHA at 100%" claim is unverifiable (the actual 100% benchmark is ETH Zurich's YOLOv8 in Sept 2024), and reCAPTCHA digitized the NYT article archive of around 13M articles, not 200M books.
Three of the widgets on this page are real, embedded with each company's published test sitekeys: Google reCAPTCHA v2 (6LeIxAcT…ZKhI), hCaptcha (10000000-…0001), and Cloudflare Turnstile (1x00…AA). All three load real third-party scripts that send observability signals to those companies, exactly as they would on any normal website. That is the editorial point of this page. The 1997, 2007, and 2018-v3 sections are local recreations, because the original widgets are retired or have no public test sitekey.
Primary sources: Plesner, Vontobel, Wattenhofer — Breaking reCAPTCHAv2 (2024) · Open CaptchaWorld (NeurIPS 2025) · unCaptcha2 (USENIX WOOT 2017) · CAPTCHA EUROCRYPT 2003 · Cloudflare Turnstile testing · Cloudflare on switching to hCaptcha (2020).
The Data Drop
Built like this. Quiet inbox. No spam. Unsubscribe one click.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。