CAPTCHA test / Museum
Every CAPTCHA here was beaten
Distorted words, cat photos, drag-and-drop puzzles, mini-games. Each one was the state of the art for a few years, each one was broken by software, each one is gone. The exhibits below keep their address forever; a living CAPTCHA that shuts down moves here without losing its page.
Timeline
Three decades in one line. Dates from vendor announcements, peer-reviewed papers and Wikipedia; each exhibit lists its own sources.
One of the first production tests to tell humans from scripts: distorted text that OCR of the time could not read.
Luis von Ahn and colleagues render dictionary words as warped images. Yahoo deploys the one-word EZ-Gimpy in chat rooms.
Von Ahn, Blum, Hopper and Langford name the concept. The same year Mori and Malik break EZ-Gimpy with a shape-matching algorithm.
reCAPTCHA turns the test into free book digitisation. Microsoft Research asks you to find the cats among twelve pet photos.
The puzzles start reading street numbers and book scans for Google.
Are You a Human replaces text with mini-games such as parking a car in a space.
Google ships "No CAPTCHA reCAPTCHA" in December. ASIRRA shuts down in October after machine learning solves it.
PlayThru is switched off on 1 March 2016; reCAPTCHA's distorted text is retired as v3 scoring arrives in 2018.
The puzzle-assembly CAPTCHA's domain stops resolving. Last checked 22 September 2026.
Exhibits
Five to start. Each card follows the same template as the living CAPTCHAs: who made it, what it asked, how it was broken, what to use today.
EZ-Gimpy
Carnegie Mellon University for Yahoo
Asked: type the single distorted word. Broken by: Mori and Malik, 2003, shape-context matching, 92% success. Use today: any invisible method.
reCAPTCHA v1
Carnegie Mellon, then Google (2009)
Asked: type two words; the unknown one digitised old books and newspapers. Broken by: OCR and deep learning; Google retired text in favour of v2 and v3. Use today: reCAPTCHA v3 or a reputation check.
ASIRRA
Microsoft Research with Petfinder.com
Asked: click all the cats. Broken by: Golle, 2008, an SVM classifier telling cats from dogs; shut down permanently in October 2014. Use today: hCaptcha or Turnstile.
PlayThru
Are You a Human (acquired by Distil Networks, 2017)
Asked: finish a tiny drag-and-drop game. Why it ended: the service was switched off on 1 March 2016; the team moved into bot-management software. Use today: a managed widget such as Turnstile.
KeyCAPTCHA
KeyCAPTCHA
Asked: drag puzzle pieces into place. Broken by: solver services sold KeyCAPTCHA answers for years. Status: keycaptcha.com no longer resolves (checked 22.09.2026). Use today: see Available cards.
The living CAPTCHAs
reCAPTCHA, hCaptcha, Turnstile, CleanTalk
Try each one on the same form with a stopwatch and see what the museum pieces cost compared with today's options.
Still running something from this room?
If your protection looks like an exhibit, see what it costs your visitors in seconds, then try the option with no CAPTCHA at all.
1,105,000+ websites protectedup to 99.97% accuracylive in 60 seconds7-day free trial, no card
Sources: Mori, Malik, "Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA", CVPR 2003; von Ahn et al., "reCAPTCHA: Human-Based Character Recognition via Web Security Measures", Science 2008; Elson et al., "Asirra", CCS 2007; Golle, "Machine Learning Attacks Against the Asirra CAPTCHA", CCS 2008; Distil Networks acquisition of Are You a Human, May 2017; Wikipedia: CAPTCHA, reCAPTCHA.
