Think for a moment about what your captcha is trying to accomplish. Here is the goal I can think of:

• Prevent a large-scale automated attack from breaking into weak accounts

Here's a way to do that which will probably make your users happier:

• If a computer successfully logs in (as Bob), set a cookie on that computer so the server knows that computer gets 5 free attempts to log into Bob's account without needing the capcha.

• If the computer trying to log in is from Bob's last known ip, give that ip 5 free attempts to log into Bob's account without needing the capcha.

The idea here is that mass password guessing usually happens from computers or ips that have legitimately logged into the account.

This can probably be improved by combining it with ideas from other answers where you give a few "free tries" to accounts or ips.

Think for a moment about what your captcha is trying to accomplish. Here is the goal I can think of:

• Prevent a large-scale automated attack from breaking into weak accounts

Here's a way to do that which will probably make your users happier:

• If a computer successfully logs in (as Bob), set a cookie on that computer so the server knows that computer gets 5 free attempts to log into Bob's account without needing the capcha.

• If the computer trying to log in is from Bob's last known ip, give that ip 5 free attempts to log into Bob's account without needing the capcha.

The idea here is that mass password guessing usually happens from computers or ips that have not legitimately logged into the account.

This can probably be improved by combining it with ideas from other answers where you give a few "free tries" to accounts or ips.