Humanity wastes about 500 years per day on CAPTCHAs. It’s time to end this madness

Five Hundred Years a Day

Click the buses. Click the bikes. Does this photo have traffic lights? CAPTCHAs have become an inescapable ritual of modern web life. They exist to separate humans from bots, but the math suggests the cost is staggering.

Based on our data, the average user spends 32 seconds on a single CAPTCHA challenge. With roughly 4.6 billion Internet users worldwide, and assuming each encounters one challenge every ten days, the arithmetic points to about 500 human years consumed daily — just to prove we aren’t machines.

Hardware security keys have been around for years, and an increasing number of phones and laptops ship with this capability built in. We’re launching an experiment to replace CAPTCHAs entirely with something faster and far less annoying.

The CAPTCHA Catch

CAPTCHAs — the term was coined in 2003 — were created in 1997 to automate the challenge-response process of telling humans and bots apart. The approach made sense at the turn of the century, but the web has moved on. As AI improved, so did the difficulty of the tests: from distorted text to OCR’d books to object identification in street photos.

That escalation creates genuine problems for real users:

• Productivity: Time and focus are lost while users wrestle with puzzles.
• Accessibility: The tests assume a level of physical and cognitive ability that not everyone has, and visual impairments can make them outright impossible.
• Cultural Knowledge: A US fire hydrant or a yellow New York cab is not universal knowledge. Even the word “cabs” isn’t common everywhere.
• Mobile Usage: For much of the world, phones are the primary Internet access point, and CAPTCHAs strain both data plans and small screens.

These issues are not new. As early as 2003, the W3C published drafts — cited in their Turing test work — pointing out the inaccessibility of CAPTCHAs.

For businesses, every CAPTCHA is a potential abandonment point. The work spent optimizing a website’s performance and flow to keep users engaged is undone when a puzzle is placed between a customer and their goal. CAPTCHAs create real costs that businesses often pass directly to users.

A Cryptographic Path Forward

Leveraging hardware security keys — devices with an embedded secret that connect to a computer or phone — we can authenticate a human without knowing which human it is. The user flow is simple:

1. The user visits a protected page, like cloudflarechallenge.com.
2. Cloudflare serves a challenge.
3. The user clicks “I am human (beta)” and is prompted for a security device.
4. The user chooses to use a hardware key.
5. The user plugs it in or taps it via NFC for a wireless signature.
6. A cryptographic attestation is sent to Cloudflare, and upon verification of the user presence test, the user gains access.

Completing this takes five seconds — not thirty-two. And privacy is protected: the attestation is not uniquely linked to the user’s device. Hardware keys from manufacturers in the FIDO Alliance share identifiers with other keys in their production batch (see Section 8 of the Universal 2nd Factor Overview). To Cloudflare, your key looks like every other key from that same batch.

This flow requires at most three clicks. No looping puzzles, no ten-headed hydra of buses waiting to be clicked.

For a good experience, we support keys that are certified by the FIDO Alliance and have no known issues per the FIDO metadata service (MDS). Our initial demo supports YubiKeys (which we focused on during testing), HyperFIDO keys, and Thetis FIDO U2F keys.

“Driving open authentication standards like WebAuthn has long been at the heart of Yubico’s mission to deliver powerful security with a delightful user experience,” said Christopher Harrell, Chief Technology Officer at Yubico. “By offering a CAPTCHA alternative via a single touch backed by YubiKey hardware and public key cryptography, Cloudflare’s Cryptographic Attestation of Personhood experiment could help further reduce the cognitive load placed on users as they interact with sites under strain or attack. I hope this experiment will enable people to accomplish their goals with minimal friction and strong privacy, and that the results will show it is worthwhile for other sites to consider using hardware security for more than just authentication.”

A Closer Look at the Tech

At its core, the experiment relies on WebAuthn Attestation, a W3C-standardized API already implemented in most modern browsers and operating systems. It provides a standard way to authenticate against the cryptographic capabilities of user devices. As the web pushes for both stronger security and better usability, we expect WebAuthn’s deployment to grow.

For a user armed with a compatible, properly configured hardware device, here’s what happens behind the scenes:

The short version: Your device has an embedded secure module containing a manufacturer-sealed secret. That module can prove it owns the secret without revealing it. Cloudflare asks for that proof and verifies the manufacturer is legitimate.

The longer version: This is about public-key cryptography and digital certificates. Public-key methods create unforgeable signatures — like a signet ring, where the imprint is the signature and the ring is the signing key. Your browser does something similar every time it verifies that the server claiming to be “blog.cloudflare.com” is legitimate. It checks a signature linked to that domain, backed by a certificate chain ending at a Certificate Authority built into your browser.

Here’s another way to picture it. Alice has a signing key in a secure laptop module. When she wants to prove to Bob that she wrote a letter, Bob asks her to sign a random challenge — some string like “musical-laboratory-ground.” Alice signs it. Bob verifies the signature against her public key, convincing him the letter was hers.

Cloudflare’s problem is scale: it can’t know every user’s signing key. Instead, the system asks a different question: prove you control a public key signed by a trustworthy manufacturer. When manufacturers ship hardware with secure modules, they attest to the module’s public key with their own digital certificate. Those certificates bind public keys to metadata like organization, validity period, and allowed use, backed by a chain of signatures leading back to the manufacturer’s root.

So when Cloudflare requests a signature, it verifies the attestation public key against a manufacturer’s public key. Your device submits a chain of certificates, each signed by its predecessor. Since the number of trusted manufacturers is small, Cloudflare can manually verify their root certificates — and when the math checks out, nothing stands between you and the page.

Privacy Without Biometrics

Designing a challenge that asks users to prove they control a key from a specific manufacturer requires striking a balance between privacy and security. The privacy model of the Cryptographic Attestation of Personhood is defined by these properties:

* A minimum of 100,000 keys per batch is required (FIDO UAF Protocol Specification #4.1.2.1.1), though some manufacturers and self-signed keys have been found to fall short.

**This would require a separate, distinct cookie to track your key — a practice antithetical to Internet privacy and this project's goals. Cloudflare has been working to eliminate cookies like __cfduid.

The objective is to verify that you are human, not which human you are. The WebAuthn API handles this separation well. Any biometric authentication, such as a fingerprint scan, takes place locally on your device — it unlocks the secure hardware module that produces a signature tied to your platform, but the biometric data itself never leaves your device.

The challenge leverages the WebAuthn registration flow. Since registration is designed for multiple authentications and we only need one, the username field is assigned a constant value across all users. This prevents deanonymization.

No Hidden Data Labeling

CAPTCHAs have long been used to label datasets that AI cannot identify — books, street numbers, fire hydrants. While this aided scientific efforts, it also allowed companies to leverage human recognition without user consent. The Cryptographic Attestation of Personhood eliminates this entirely, and because it isn't constrained by the CAPTCHA challenge model, the user flow can be designed more flexibly.

Pushing Privacy Further

Knowing the key manufacturer is still necessary — Cloudflare must confirm that certificates come from untampered hardware. The company has previously led privacy efforts like Privacy Pass, which lets users solve a challenge once and reuse the proof, dramatically reducing the number of CAPTCHAs VPN users encounter.

For the Cryptographic Attestation of Personhood, Cloudflare is exploring Zero Knowledge proofs. ZK proofs would allow users to demonstrate their key's manufacturer belongs to a trusted set without revealing which one. Devices from different manufacturers would become indistinguishable. This system is still in development and warrants a dedicated post.

An Ongoing Effort

Protecting millions of Internet properties demands continuous refinement. The Cryptographic Attestation of Personhood offers strong security and usability compared to traditional CAPTCHAs. An initial user study showed a clear preference for touching a hardware key over identifying pictures. Still, it's a new system with room to grow.

The experiment is currently available on a limited basis in English-speaking regions to test across different locations and user pools. That coverage is acknowledged as insufficient, and broader testing is planned.

Security hinges on the integrity of trusted manufacturers' hardware. If a compromise occurs, Cloudflare can quickly revoke manufacturers' public keys at various levels of granularity.

Automated button-pressing is also a consideration. A drinking bird could theoretically pass the capacitive touch challenge, but only at the speed of hardware attestation generation. With the current set of trusted manufacturers, that's slower than professional CAPTCHA-solving services — all while legitimate users pass through instantly. Existing Cloudflare mitigations remain active as an additional layer.

The Bottom Line

Cloudflare's mission is building a better Internet. The notion that humanity collectively wastes 500 years per day on CAPTCHAs — with core assumptions unchanged since the turn of the century — was the catalyst. The Cryptographic Attestation of Personhood was built with a user-first approach and high security standards. It's now being integrated into Cloudflare's humanity challenge system and will appear more frequently over time. It's available today at cloudflarechallenge.com.

The Research team leads this effort, with support across the company. The goal is the end of the Internet's fire hydrant — and it's no longer needed.

Feedback and Compatibility Notes

This experimental project currently supports only USB or NFC security keys. Non-supported devices will trigger errors from your browser. On Google Chrome, you'll see something like:

Other authenticators are being considered for future support. Feedback on the Cryptographic Attestation of Personhood can be submitted via this Google Form.