Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are effective CAPTCHA solutions that can have localized description, and CAPTCHA text itself is either language-neutral, or can be localized (for Polish language)? It is to be used to protect a kind of contact form.

reCAPTCHA (for example) allows i18n of the widget, but this still uses English source text that is then machine-translated. This makes it, I think, harder to solve for people who do not know English at all. I suspect it is even worse for the audio version of CAPTCHA.

share|improve this question

It is not too difficult to roll your own basic CAPTCHA, or there are numerous tutorials and scripts out of the web.

I've used a simple one in PHP based on random letters/numbers, feel free to take and modify for your purpose:

// first generate random $string

$pa_captcha_salt = 'random stuff';
$hash = md5( $string.$pa_captcha_salt );
$filename = $_SERVER['DOCUMENT_ROOT'] . '/media/captcha/' . $hash . '.gif';

$font = 5; // font size
$width = ImageFontWidth($font) * strlen($string) + 4;
$height = ImageFontHeight($font) + 4;
$im = ImageCreateTrueColor($width, $height);

$textColor = ImageColorAllocate ($im, 99, 99, 99); // grey text
ImageString($im, $font, 2, 2, $string, $textColor);
ImageGif($im, $filename); // save file
share|improve this answer
Unfortunately it presents easy to break CAPTCHA (insecure image), and not so secure implementation (common salt rather than unique salt, not so secure md5, hash instead of HMAC; I don't see protection againts replay attack either). – Jakub Narębski Nov 8 '10 at 16:46
@Jakub: Sure, this was just a bare-bones example that works fine for most purposes. md5 is fine if you are using a salt but sha1 or whatever is better. Common salt is fine and pretty hard to break (obviously you'd use a long jumbled string not real words). The example above is also missing the part after submission, that checks that the image is valid and deletes old images regularly. So no, it's not the most secure CAPTCHA in the world but it's good enough for 90% of purposes. – DisgruntledGoat Nov 8 '10 at 18:12

Are you limited to scrambled text CAPTCHA's or will any Turing test work?

It would take more time to implement, but you could use one of the many other variations on challenge-response CAPTCHA in a localized environment.

My best recommendation would be to use a text-scrambling solution like the one offered by DisgruntledGoat with math questions - i.e. a slightly-wavy representation of "1 + 1 = ?" appears... but you have lots of other localization-ready options.

share|improve this answer
It might be a good idea to replace the numbers and symbols with the corresponding words in the localized language. Though you may need to take the grammatical rules of each language (as well as text direction) into account. Also, make sure that the format of the math problem is varied. Otherwise, if the attacker knows that it's always [number] [operator] [question mark] [equal sign] [number], then he has far fewer possible answers to test. – Lèse majesté Nov 9 '10 at 9:45
@Lèse majesté - The "x + y = z" format is more friendly to on-the-fly audio CAPTCHA generation (i.e. "how many beeps/dog barks/et cetera did you hear?") - though I agree that creating a question grammar would be a good idea if one expects to see a botnet testing the CAPTCHA (otherwise a "ten strikes and your IP is blocked for an hour" automated administration approach seems more appropriate to the potential threat) – danlefree Nov 9 '10 at 10:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.