Why captchas were created

A public form is an open door. Account signup, comment boxes, search, and "add this URL" were all callable by anyone who could send an HTTP request. In the late 1990s that became a practical problem. A script could create thousands of free email accounts, post the same comment everywhere, or stuff a search engine with links.

The early answer was a test the server could grade by itself. AltaVista, around 1997, asked visitors to type distorted text before a URL would be added to its index. The text was a new picture each time, so a program that only replayed an old answer failed. A few years later the same need showed up at Yahoo, where scripts were opening mail accounts in bulk. The Carnegie Mellon project that named the CAPTCHA was built for that kind of abuse.

The goal was narrow. The captcha checks that this submission was tied to a fresh challenge. It does not identify the person. It does not replace a password, a rate limit, or an account. A site that puts a captcha on every click is using it past that job, and people leave. A site that puts it on the one route a script was hammering is using it as designed.

Programs got better at reading warped letters, so the tests changed. Photo grids and silent risk scores are later answers to the same original problem: a form that is free to call will be called. The history is that sequence. The reason it started is the open form.

Captcha OCR is a reader for the image types it supports, for work you are allowed to submit. Reading the picture does not grant access to someone else's account. A captcha does not identify you is the product note on that point.