Somewhere around 2014, the CAPTCHA quietly stopped being a puzzle. For years, the standard test of humanity was a smear of warped letters that you squinted at, guessed, and usually got wrong on the first try. Then Google shipped a version that just asked you to tick a box. No letters, no traffic lights, no fire hydrants — at least not for most visitors. Tick the box, and the page lets you through. It felt like the site had simply stopped bothering.
It had not stopped bothering. It had started watching the mouse.
The box is a decoy
Google’s reCAPTCHA v2, introduced as the “No CAPTCHA reCAPTCHA,” is built around a simple observation: telling a human from a bot is much easier if you look at how the visitor behaves before, during, and after the click, rather than at the click itself. The checkbox is a stage. What Google’s script is actually recording, from the moment the page loads, is a stream of tiny events — mouse coordinates sampled dozens of times a second, scroll speed, the exact millisecond gaps between keystrokes, touch pressure on a phone, even the way the browser’s rendering engine handles a hidden canvas.
Google has never published the full ingredient list, and deliberately so — the moment the exact signals are known, they can be faked. But the company has confirmed in its own research and patents that mouse movement and interaction timing are central to the score. A 2013 patent filed by the reCAPTCHA team describes the technique almost plainly: distinguish humans from automated agents by analysing the trajectory, velocity, and acceleration of the cursor as it approaches the target.
Why bots move in straight lines
A bot driving a browser is usually a script telling a headless engine — Puppeteer, Selenium, Playwright — to move the mouse from point A to point B. The naive version does exactly that: it teleports the cursor, or interpolates a perfect straight line between the two points at a constant speed. Even more sophisticated bots that try to look human tend to use Bézier curves, sine-wave wobbles, or pre-recorded paths. All of these leave fingerprints.
A Bézier curve is mathematically smooth. Its second derivative — the acceleration — is continuous and predictable. A human hand is not. When a person reaches for a checkbox with a trackpad or mouse, the movement is produced by dozens of muscle fibres firing in imperfect concert, corrected in flight by visual feedback from the eye, and slowed by a small overshoot-and-return as the cursor closes on the target. The result is a path that jitters at roughly 8 to 12 Hz — the natural tremor frequency of the human hand — and decelerates in a very specific way that motor-control researchers call the Fitts’s law profile. The cursor accelerates hard, coasts, then makes several small corrective jerks near the end. A bot’s smooth curve has none of this.
Researchers at Zurich’s ETH and elsewhere have shown that even fairly short segments of mouse trajectory — a couple of seconds — carry enough signal to classify human versus automated movement with accuracy above 95%. The features that matter are boringly physical: velocity distribution, angular changes, dwell times, and the ratio of straight-line distance to actual path length. Humans almost never take the shortest route.
What the script actually collects
When a page loads reCAPTCHA, the script begins recording an event log. Every mousemove, mousedown, scroll, keypress, and touchstart event fires a callback that stores a timestamp and coordinates. Over the few seconds a visitor spends on the page, that produces hundreds or thousands of data points. The script also reads passive browser signals: user agent, screen resolution, installed plugins, WebGL rendering quirks, time-zone offset, and the presence or absence of features that automation frameworks are known to expose or hide.
All of that — mouse trace, timing, browser fingerprint, and any Google cookies the visitor happens to be carrying — is bundled up, encrypted, and sent to Google’s servers when the box is ticked. A model on the other end returns a score. If the score is confidently human, the checkbox turns green and the page continues. If not, the visitor is escalated to the familiar image challenge: pick the crosswalks, pick the buses. Those images are the fallback, not the primary test.
The image challenge, incidentally, has always had a second job. Early reCAPTCHA used scans of old books that Google Books’ OCR could not read, turning millions of humans into unpaid transcribers. The traffic-light and crosswalk puzzles served the same double purpose for Google’s self-driving car project: every time a visitor labelled a bus, they were annotating training data for a computer-vision model.
reCAPTCHA v3 stops asking altogether
In 2018 Google went a step further. reCAPTCHA v3 has no checkbox at all. It runs invisibly on every page of a site, continuously scoring every visitor from 0.0 (almost certainly a bot) to 1.0 (almost certainly a human). The site owner decides what to do with the score — allow the login, require a second factor, silently shadow-ban the account. The visitor never knows they were tested.
This is possible because the mouse and keyboard signals are rich enough to identify humans without any explicit challenge. A visitor who arrives on a login page, moves the cursor in a natural arc down to the username field, types with realistic inter-key timing, tabs to the password field, and clicks submit has produced a behavioural signature that a script would have to work extraordinarily hard to imitate. The score is computed and dispatched before the visitor even realises they were being watched.
An arms race that has moved off-screen
Bot developers know all of this, and the better ones now inject synthesised human-like mouse traces into their automation frameworks. There are open-source libraries — Ghost Cursor is a well-known one — that generate Bézier paths seeded with random jitter and Fitts-law deceleration. Some commercial CAPTCHA-solving services train neural networks on recorded human sessions and replay statistically indistinguishable movements.
So the defenders respond with signals the attackers cannot easily fake. Touch pressure on mobile devices. The precise entropy of accelerometer data — the same silicon gyroscopes that tell your phone which way is up also produce a faint, unique noise pattern from your hand’s tremor as you hold the device. Battery-drain curves. The time it takes a browser to execute a specific piece of JavaScript, which varies by CPU model in ways that headless automation tends to normalise away. Cloudflare’s Turnstile, Apple’s Private Access Tokens, and hCaptcha all now lean heavily on cryptographic device attestation — the browser or operating system proves that a real human unlocked a real phone, and the CAPTCHA becomes a check of that proof rather than a behavioural test.
The wobbly-letters CAPTCHA of the 2000s is, at this point, a museum piece. It was defeated by optical character recognition years ago, and the puzzles that replaced it are largely theatre. The real test happens in the milliseconds before the click, in the tiny, unrepeatable curves your hand traces without noticing. You’ve been passing it, or failing it, every time you tick a box.
