SSOGEN / Learn / CAPTCHA Alternatives: Stopping Fake Sign-Ups Without a Picture Puzzle
Learn
CAPTCHA Alternatives: Stopping Fake Sign-Ups Without a Picture Puzzle
The strongest CAPTCHA alternatives are layers, not a single test: a proof-of-work puzzle that makes each automated request cost effort, rate limits that cap volume, disposable-email blocking, an identical answer for every address, and approval where accounts matter.
Updated
The answer: the CAPTCHA alternatives that work on a sign-up page are layered controls, not one replacement test. A proof-of-work puzzle raises the cost of each automated request. Rate limits cap how many requests get through. Disposable-email blocking and domain lists filter addresses. An identical answer for every address stops account probing. Approval catches what remains.
None of these asks a person to read warped letters or pick traffic lights. That matters, because the picture puzzle is also the part that fails real users.
What an image CAPTCHA costs
The W3C note Inaccessibility of CAPTCHA (Group Draft Note, December 2021) sets out the costs:
- Screen readers cannot process the image. Blind users depend on the audio version.
- Audio versions fail too. Distorted audio excludes deaf-blind users, people without working sound and people in noisy places.
- Distortion hurts more people. Low vision, dyslexia and other cognitive disabilities make warped text hard to read.
- Bots solve them anyway. The note cites a study with a 90% success rate against Google’s audio reCAPTCHA, and says human solving farms defeat puzzle challenges.
OWASP’s Authentication Cheat Sheet agrees on the second point. It calls CAPTCHA a defense-in-depth control that makes attacks “more time-consuming and expensive”, because many implementations can be solved automatically.
The layers, and what each one stops
OWASP names the threat OAT-019 Account Creation: bulk sign-ups through the normal registration process, later used for spam, fraud or skewed reviews.
| Layer | What it does | What it does not do | Cost to a real person |
|---|---|---|---|
| Proof-of-work puzzle | Makes each request cost CPU time | Stop a patient, well-funded attacker | A short wait, no interaction |
| Rate limit per address | Stops mail floods to one victim | Stop many different addresses | None at normal use |
| Rate limit per domain | Caps bulk sign-ups from one mail domain | Stop many domains | Rare, at very high volume |
| Rate limit per network | Caps one source | Stop a botnet spread over many networks | Rare, on shared networks |
| Disposable-email blocking | Refuses throwaway inboxes | Stop real free mailboxes | A person must use a lasting address |
| Allow and block domain lists | Restricts sign-up to known companies | Help an open consumer site | Outsiders cannot sign up |
| Same answer for every address | Hides which addresses have accounts | Slow anything down | None |
| Approval | A person decides before the account exists | Scale to consumer volume | A wait for the decision |
Proof of work: a cost, not a wall
A proof-of-work puzzle asks the browser to find a number that, hashed with a server challenge, gives a SHA-256 result starting with a set number of zero bits. The W3C note lists proof of work among the non-interactive alternatives.
Finding the number takes many attempts. Checking it takes one hash. Each extra zero bit doubles the expected work:
| Required zero bits | Expected hashes per request |
|---|---|
| 8 | 256 |
| 16 | 65,536 |
| 20 | about 1 million |
| 24 | about 16.8 million |
What it achieves. A real person pays the cost once, in the background. A bot creating thousands of accounts pays it thousands of times.
What it cannot achieve. An attacker with enough hardware still solves every puzzle. Proof of work is a mitigation: it slows automated sign-ups and raises their cost. The rate limits are what stop volume.
Design points.
- Sign the challenge. The server must recognize challenges it issued, so sign each one with a key only the server holds.
- Bind it to the client. Tie the challenge to the client’s network so a solved puzzle cannot be passed around.
- Use it once, briefly. Accept each solution one time, within a few minutes.
- Keep it first-party. A puzzle computed by your own page needs no third-party script and sends no visitor data elsewhere.
Rate limits at four levels
One limit is never enough, because attackers spread requests along whichever dimension is unlimited. Count at four levels:
- Per address. A few verification emails a day per address protects the inbox owner from a flood.
- Per email domain. An hourly cap per domain stops thousands of sign-ups at one domain.
- Per organization. An overall hourly cap bounds the damage of a distributed attack, and limits what any one network may take of it.
- Per network. A per-minute cap per client network slows one source. Count IPv6 clients by prefix, not by single address, because one subscriber often holds a whole prefix.
NIST SP 800-63B-4, section 3.2.2, applies the same idea to sign-in. It limits consecutive failed attempts to 100 per account and allows lower limits, waits between attempts and a bot detection challenge.
Disposable addresses and domain lists
Throwaway inbox services exist to receive one message and vanish. Blocking their domains removes the cheapest supply of fake mailboxes. Keep the block list current; new services appear often.
For a partner or supplier portal, go further. An allow list of customer domains admits only known companies. A block list refuses specific domains while leaving sign-up open to everyone else.
The same answer for every address
A sign-up page that says “this email is already registered” tells an attacker which addresses hold accounts. They feed those to credential stuffing.
OWASP’s guidance is to respond generically for account creation, for example “A link to activate your account has been emailed to the address provided”, whether or not the account exists. Response time and HTTP status must not differ either.
The order of checks on one sign-up request
- Verify the puzzle: signature, client network, single use and age.
- Apply the per-network and per-organization limits.
- Check the domain: disposable, blocked or not on the allow list.
- Apply the per-domain and per-address limits.
- Return the same message for every address.
- Send the verification code only where every check passed.
- Create the account only after the mailbox is proved and, where required, a person approves.
Cheap checks run first, so a flood is turned away before it costs mail or database work.
Questions people ask
Is CAPTCHA by Google?
No. CAPTCHA is a general technique, and many companies offer one. Google’s product is reCAPTCHA, the most widely recognized version, which the W3C note discusses alongside other approaches. Choosing a CAPTCHA alternative is not only about leaving Google: picture puzzles from any vendor carry the same accessibility costs.
What are some synonyms for CAPTCHA?
Common synonyms include human verification, challenge-response test, bot check and “I’m not a robot” check. The acronym stands for Completely Automated Public Turing test to tell Computers and Humans Apart. The W3C calls the family visual and audio Turing tests. Proof-of-work puzzles are related but ask nothing of the person.
Can a CAPTCHA alternative stop every bot?
No single control can. A proof-of-work puzzle slows bots, rate limits cap their volume, domain rules filter their addresses and approval catches what slips through. The goal is to make fake sign-ups slow, costly and visible, while real people see nothing extra.
Does proof of work hurt users on slow phones?
It adds a short delay, and the cost scales with the difficulty you set. Keep the difficulty low and rely on rate limits for volume. A delay of a moment in the background is still far less work than an image puzzle, and it requires no sight, hearing or fine motor control.
How SSOGEN protects sign-up without a CAPTCHA
SSOGEN’s sign-up page solves a SHA-256 puzzle in the browser before each request: no picture, no third-party script. Each challenge is signed with the organization’s own key, bound to the client network and accepted once within 5 minutes. The puzzle slows automated sign-ups; the limits stop them: 3 emails a day per address, 100 an hour per domain, 300 an hour per organization. Disposable domains are blocked by default; every address gets the same answer. See customer identity.
Where to go next
- Choosing the route in. Invitation vs self-registration covers approval and link lifetimes.
- The bigger picture. CIAM vs IAM explains customer identity.
- More explainers. The Learn hub lists related pages.
Sources, all read 2026-11-15:
- W3C, Inaccessibility of CAPTCHA, Group Draft Note, 16 December 2021.
- OWASP Authentication Cheat Sheet, sections on authentication responses and CAPTCHA.
- OWASP Automated Threats, OAT-019 Account Creation.
- NIST SP 800-63B-4, section 3.2.2.