Glossary
What is a CAPTCHA farm?
Definition
A CAPTCHA farm is a human solving service. People are paid to answer CAPTCHA challenges on behalf of someone else's script.
How it works
- The attacker's script captures the challenge.
- It sends the challenge to the service, where a person solves it.
- The answer returns to the script, which submits the form with a valid token.
Where it matters
- OWASP lists human farms next to optical character recognition and image-matching databases as ways CAPTCHAs are defeated.
- Because farms use real people, per-account limits and server-side checks matter more than puzzle difficulty.
In CaptchaKit
CaptchaKit's tokens are single use and expire in 10 minutes, and issuing and completion are rate limited per site key. That limits how fast a farm can feed it, not whether it can.
Questions
Does OWASP cover this?
Yes. OAT-009 lists human farms among the ways CAPTCHAs are defeated.
Can I detect a farm?
Look for unusual solve rates, repeated solves from far apart networks and odd timing.
Do farms beat game CAPTCHAs?
A person can play a game. That is why rate limits and server checks matter.
Source
- OWASP OAT-009 CAPTCHA Defeat (checked 2026-10-18)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.