GCSE · Computer Science · AQA · Spec 8525

CAPTCHA

Ever had to pick every picture with a bicycle to get into a website? That's a test, and it's aimed at robots, not you.

Computer Science · Computer security

Could this task be a CAPTCHA?

A website wants to tell humans from bots by setting a task. For each task below, decide: is it easy for a person? Is it hard for a computer program? Tick one set, both, or neither, then check. Which tasks end up in the overlap?

  • A Easy for a person
  • B Hard for a computer program
  1. Reading distorted letters and numbers
  2. Picking the images that contain a given object
  3. Ticking a box while the site analyses how you behave
  4. Typing your own name
  5. Adding up a list of 5,000 numbers by hand
  6. Predicting next week's lottery numbers

Exam line: Check both conditions: easy for a person, and hard for a computer program.

What is it really checking?

Which idea sounds like you?

You tick an 'I'm not a robot' box to get into a website's sign-up page.

What do you think that box is actually checking?
How sure are you?

Exam line: A CAPTCHA tests human versus automated program. It is not an identity check and not a password check.

Computer Science · Flowcharts

What happens when a form has a CAPTCHA?

Step through the path a wrong response takes. Watch the one decision box.

A program gives the wrong response to the task. Which way does the decision go?

YesNoStart: form is submittedSite shows the CAPTCHA taskUser gives a responseIs the response correct?Access allowed: form is submittedAccess refused: submission is not acceptedEnd

Output

Step 1: Someone, or some program, tries to submit a form that is protected by a CAPTCHA.

1 / 6

Step through with Next and keep your eye on the diamond.

Step 1 of 6: Someone, or some program, tries to submit a form that is protected by a CAPTCHA..

Exam line: Access is allowed only if the response is correct; an incorrect response means the submission is refused.
Watch out: The decision is about whether the response is correct. It isn't about who sent it or what their password is.

Is it worth it?

Should this website use a CAPTCHA?

The claim

A website should put a CAPTCHA on its sign-up and login forms.

Place each piece of evidence to load the balance. Mark the strong ones — they count double.

  1. If every login attempt needs a response, a program trying password after password (brute-force guessing) is held up.

    Evidence 1: does it support or challenge the claim?

  2. A program creating lots of fake accounts has to get past the task each time.

    Evidence 2: does it support or challenge the claim?

  3. Spam sent through forms by programs is harder to send when each message needs a response.

    Evidence 3: does it support or challenge the claim?

  4. Some people with impairments find the task hard, so sites offer alternatives such as audio versions.

    Evidence 4: does it support or challenge the claim?

  5. Genuine users can find CAPTCHAs annoying.

    Evidence 5: does it support or challenge the claim?

  6. Advanced software can sometimes solve them.

    Evidence 6: does it support or challenge the claim?

Exam line: Give at least one benefit and one limitation, then reach a judgement and say why.

Have a go

Explain it in your own words

Brute-force password guessing means a program trying password after password until one works.

Explain how a CAPTCHA helps to prevent a brute-force attack on a login page. [3 marks]

0 words · your answer stays on this page and is not sent anywhere.

Exam line: Link the mechanism to the outcome: the task is hard for a program, so it can't keep guessing automatically.

What you need to know

  • CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart.
  • Its job is to tell human users apart from automated programs, often called bots.
  • It does that by setting a task that is easy for a person but hard for a computer program.
  • A task must pass both tests: easy for people AND hard for programs. Fail either and it won't work.
  • Have a goSam says: 'My CAPTCHA is unbeatable. It asks you to count every grain of sand on a beach!' Does Sam's task work? Check it against both tests.

    No. It's hard for a program, but it isn't easy for a person either.

    A CAPTCHA task has to be easy for a person AND hard for a program. Hard for everyone fails the first test.

  • Typical tasks are reading distorted letters and numbers, picking images that contain a given object, and analysing behaviour.
  • A CAPTCHA does not check who you are or protect your password. It checks that a human is using the site.
  • Have a goSomeone passes a CAPTCHA and says, 'So the site now knows exactly who I am.' What have they got wrong?

    Passing only shows a human is there, not which human.

    A CAPTCHA tests human versus automated program. It isn't an identity check and it isn't a password check.

  • After the task, access is allowed only if the response is correct. If it isn't, the submission is refused.
  • It helps against automated attacks such as brute-force password guessing, fake accounts and spam.
  • Have a goA contact form is flooded by a program sending message after message. Why might a CAPTCHA on the form help?

    The program has to complete a task it finds hard each time.

    The task is designed to be hard for a program, so automated sending is held up. It helps, but it isn't guaranteed to stop every program.

  • A limitation: it can be hard for some people with impairments, so alternatives such as audio versions are offered.
  • It can also annoy genuine users, and advanced software can sometimes solve it.

The big picture

A CAPTCHA is a test that tells human users apart from automated programs. It sets a task that is easy for a person but hard for a computer program, and lets the user through only if the response is correct. That helps against automated attacks such as brute-force password guessing, fake accounts and spam, but it has limits too.

Key points

1A CAPTCHA tells humans and automated programs apart. It does not identify you or check your password.
2A task works as a CAPTCHA only if it is easy for a person and hard for a computer program.
3Access is allowed only when the response is correct; otherwise the submission is refused.
4It helps against brute-force guessing, fake accounts and spam, but it can exclude or annoy genuine users, and advanced software can sometimes solve it.

Worked example

Problem

A website wants to stop programs creating fake accounts. It is choosing between two tasks: (a) 'Type the answer to 5 × 5' or (b) 'Type the distorted letters shown in the picture'. Which would work as a CAPTCHA?

⚠ Watch out

Thinking a CAPTCHA checks who you are or protects your password. It only checks that a human, rather than an automated program, is using the site.

🧠

Memory hook

Easy for ME, hard for a BOT. Only the overlap makes a CAPTCHA.

✓

Check yourself

Think of a CAPTCHA you've met online. Which task did it set? Say how it passes both tests, and one thing that could go wrong for a genuine user.

Flashcards

(11)
What does CAPTCHA stand for?
Completely Automated Public Turing test to tell Computers and Humans Apart.
What is the job of a CAPTCHA?
To tell human users apart from automated programs (bots).
What kind of task does a CAPTCHA set?
One that is easy for a person but hard for a computer program.
A task is easy for everyone, programs included. Could it be a CAPTCHA?
No. It fails the 'hard for a program' test, so it can't tell a human from a bot.
A task is hard for everyone, people included. Could it be a CAPTCHA?
No. It fails the 'easy for a person' test, so genuine users couldn't pass either.
Name three kinds of CAPTCHA task.
Reading distorted letters and numbers; picking images that contain a given object; analysing behaviour.
Does a CAPTCHA check who you are or how strong your password is?
No. It only checks that a human, rather than an automated program, is using the site.
When does a CAPTCHA allow access?
Only if the response to the task is correct. Otherwise the submission is refused.
What is brute-force password guessing?
A program trying password after password until one works.
Which automated attacks can a CAPTCHA help against?
Brute-force password guessing, fake accounts and spam.
Give three limitations of CAPTCHAs.
Hard for some people with impairments (so alternatives such as audio versions are offered); can annoy genuine users; advanced software can sometimes solve them.

Tap any card to flip it, or use Study as deck to go through them one at a time. In the full lesson these run as a spaced-repetition deck — you rate each card Hard, Good or Easy and the tricky ones keep coming back until they stick.

Learning with Lightbulb is opening soon

You can use this lesson now. Join the waitlist and we'll let you know when the full Lightbulb experience is ready.

Keep me posted

More AQA GCSE Computer Science topics

See the full AQA Computer Science curriculum →

How this lesson was checked. This AQA GCSE Computer Science (specification 8525)lesson was published through Lightbulb Learning's human-designed editorial process — the educational standards, accuracy rules and publication checks it must pass were authored and approved by Philip Halpin. It passed subject-specific assessment, automated educational checks and technical publication verification before going live (publication checks completed 9 October 2026). Published pages are monitored, human spot-checking is ongoing across the lesson library, and anything found wrong is corrected or withdrawn. How our lessons are made and checked. Spotted a mistake? Email hello@lightbulblearning.co and we'll review it.