I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives:


Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right image?

Also, the whole process is initiated by sending a start/X request, where X is the number of options to generate. As far as I can tell, a bot might initiate with X = 2 instead of 5 and get 50% of the tries right.

  • 1
    I'd argue this is actually weaker. A lot of Captcha circumvention services these days are actually using humans instead of computers. For a human, it's much faster to click on one thing than it is to type several characters or a couple of words. Therefore a human-driven Captcha circumvention service would be able to attack this form at a significantly higher rate than traditional Captcha.
    – Iszi
    Mar 13, 2015 at 20:48
  • a neural network was made that identified these objects in real life with bad lighting, a bad background, and a corrupted image. Definitely not. Jul 11, 2016 at 16:31

5 Answers 5


There are two considerable weaknesses in the live demo which make it quite trivial to break:

  1. There are only 5 possible answers to the captcha question, so a bot has a 20% chance to solve the captcha by picking a random symbol. The demo didn't ban me after picking a wrong answer over 20 times in a row, so there is no reason why a bot can't just keep guessing until it got a correct answer by chance.
  2. There is only a very limited set of images which are in no way altered. They appear under different URLs, but always look the same, so a bot can identify them by loading and decoding the images. Also, the system refers to each image with the same word every time. That would allow to simply tell the bot which word means which image.

Some ideas to make the captcha stronger:

  • Ask the user to mark multiple objects and only let them pass when they marked these and only these objects. That would make random guessing much less efficient.
  • Ban IP addresses for a few minutes after many wrong answers in a row
  • Use a much larger set of images
  • Use an even larger dictionary of strings to refer to them
  • Use image altering algorithms with randomized parameters to alienate the images a bit so it gets harder to recognize them automatically

Keep in mind that no captcha is truly unbreakable. All you can hope for is to increase the effort an attacker needs to invest to break it. But that can be all you need. Captchas are one of the few areas where security through obscurity can pay off. Spammers look for low-hanging fruits. When you use an obscure home-brewed captcha solution and aren't a particularly valuable target, many spammers will just be too lazy to figure it out. When you are a particularly valuable target, they will just hire a bunch of people from a 3rd world country to solve your captchas. And you can not defend against this without also making your website unusable for regular users.


To try it out, I've written a small bot that tries to post the the visual captcha demo.

If first initiates the captcha session, telling is only wants 2 options using http://demo.visualcaptcha.net/start/2. Than it picks one of the two possible results and posts to http://demo.visualcaptcha.net/try.


Of the 250 tries, I succeeded 127 times and failed 123 times.

VisualCaptcha is clearly very unsafe.

Using a fixed number of images (eg 5), instead of letting the client pick the number of images, would help to reduce the successful tries to 1 in 5. Though I recon that's not sufficient for most use cases.


 * Try posting to the visualCaptcha demo
 * @return boolean  true if posted successfully
function tryVisualCaptcha()
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_COOKIEJAR, "/tmp/visualcaptcha-cookies.txt");
    curl_setopt($curl, CURLOPT_COOKIEFILE, "/tmp/visualcaptcha-cookies.txt");

    curl_setopt($curl, CURLOPT_URL, "http://demo.visualcaptcha.net/start/2");
    $ret = curl_exec($curl);
    $result = json_decode($ret);

    $post = [$result->imageFieldName => $result->values[0]];

    curl_setopt($curl, CURLOPT_URL, "http://demo.visualcaptcha.net/try");
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($post));

    $info = curl_getinfo($curl);
    return strpos($info['redirect_url'], 'validImage') !== false;

// Main
$results = [0 => 0, 1 => 0];

for ($i = 1; $i <= 250; $i++) {
    $success = tryVisualCaptcha();

    echo $success ? "✓" : "☓", $i % 50 === 0 ? "\n" : "";

echo "Of the ", array_sum($results), " tries, I succeeded ", $results[1],
  " times and failed ", $results[0], " times.\n";

All one would need to do is split the captcha into individual images and perform a Google image search of each image and the target word. And simply pick whichever one has the most results .From that point I am fairly sure that one could get pretty damn high accuracy.

You can do a search for

"Type below the answer to what you hear" OBJECT

where OBJECT is the word of the picture.

Examples: Lamp, Car, Lock, Flag.

  • Great find! I've added some examples. Mar 14, 2015 at 18:23
  • Not exactly what I had in mind but still appears to work . Mar 14, 2015 at 23:00

VisualCaptcha is an excellent solution for UX, but can be broken with 100% success rate.

As Proof-of-Concept, there is a little script to break 100% VisualCaptcha included in this blog post

There are several techniques to increase the security of VisualCaptcha. These techniques will not be integrated in the "core" of VC, but a developer can decide to implement them if needed, as discussed with Bruno Bernardino.


Full disclosure: I'm the "inventor" of visualCaptcha.

First of all, I love seeing so much people interested and using visualCaptcha. It's been getting a lot of attention and love in the past 6 months. It's amazing to see more and more people using it and interested in improving and "cracking it".

I do want everyone to understand the problem visualCaptcha solves is the User Experience of Captchas, while not being insecure (or as insecure as most visual captchas, when this one was created).

If you need a very secure captcha, there are plenty out there, like ReCaptcha, but your users will get a worst experience (Google's been working hard on that, though, good stuff).

Ultimately, it's up to you to decide what's most important for your use case.

Philip made a great point about it not being worth it for spammers to break your captcha. One of the great things about visualCaptcha is the customizability. You can easily switch around how it works (URLs, images, number of images, etc.) and so it'll always be harder for them to eventually bother to create something to crack it.

Also, many well-known government websites around the world use customized versions of visualCaptcha very successfully. There hasn't been one complaint about it being "broken" by a bot. And when that happens, we'll help through preventing that.

Some other URLs for reference: https://github.com/emotionLoop/visualCaptcha/issues/2 https://github.com/emotionLoop/visualCaptcha/issues/8

  • 1
    So let me get this straight, visual captcha exists to make users think that there is a captcha in place without providing an adequate Turing test ? Mar 14, 2015 at 23:05
  • Hey, Damian. Thank you for your comments. That is not the point of visualCaptcha, like I've mentioned, things are secure. No app/website owners with visualCaptcha have been compromised. It's all about the UX, though. It's important for the users to NOT have to think if there's a captcha or not, but for the app owners to feel like they're not crippling the experience while having a decent level of security. Mar 15, 2015 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .