“What is a game CAPTCHA and how does it work?”
What is a game CAPTCHA and how does it work?
Short answer
A game CAPTCHA asks the visitor to finish a short mini-game instead of picking images or typing letters. CaptchaKit shows one of 18 arcade games, then issues a signed one-time token that your server verifies through a POST to /api/verify. Tokens expire in 10 minutes and work once.
Steps
- 1
The widget loads
Your page loads widget.js from captchakit.com. The script injects an iframe where your div sits, so the game code and completion logic are served by CaptchaKit, not by your site.
- 2
The game asks for a challenge
When the game opens, the iframe requests a short-lived, single-use challenge token tied to your site key and the game.
- 3
The visitor plays
The visitor wins a short game. The widget counts pointer and key interactions as they play.
- 4
A pass token is issued
On a win, the iframe sends the challenge token and the interaction count. A signed pass token is issued only if the challenge is valid, unused and not too fresh. The token is stored in the div's data-token attribute.
- 5
Your server verifies it
Your server posts the token and site key to /api/verify with your API key. A valid, unused token returns { "success": true }. A used one returns success: false.
The idea in plain words
A CAPTCHA is a test that tries to tell a person from a script. The classic versions ask you to read distorted text or pick traffic lights. A game CAPTCHA swaps that for a small game: Connect 4, a maze, a sorting task. The W3C's note on CAPTCHA says plainly that the traditional character-based version is largely inaccessible, which is one reason people look for other forms.
A game is also easier to brand. You can pick one that fits the form, like Whack-a-Bot for logins or Fruit Sorter for checkouts.
What stops a script from skipping the game
The pass token is not minted unless several things line up. A challenge must come first, and it can only be used once. A completion that arrives in under 1.2 seconds is rejected. The widget has to report some pointer or key interaction, and zero counts as a headless client. Requests are rate limited per site key. The server also re-checks that the site key owns the game.
These steps raise the cost of abuse. They are not a promise that nothing can get through, and no client-side game can offer that promise. OWASP's list of automated threats names puzzle mini-games among CAPTCHA types that attackers try to defeat. Read are game CAPTCHAs secure for the honest version.
People who cannot play
Every widget includes a "Can't play? Accessible check" link. It switches to a screen-reader-friendly question and issues the same pass token if answered, so your verify code does not change. All games are playable from the keyboard (arrows, space, enter or number keys, depending on the game) and announce progress through live regions. Test it on your own page. See are CAPTCHAs accessible.
What the embed looks like
The front end is one script tag and one div. This is the snippet from the docs:
Add the widget script once, then put the widget div inside your form. When the visitor passes, a gamecaptcha:pass event fires and the token sits in data-token.
The server step is shown in how to verify a CAPTCHA token on your server.
<script src="https://captchakit.com/widget.js"></script>
<form>
...
<div data-gamecaptcha data-site-key="gc_connect4_your_key_here" data-game="connect4"></div>
</form>Game CAPTCHAs versus other kinds
Text CAPTCHAs ask you to read warped characters. Image CAPTCHAs ask you to pick matching pictures. Checkbox and risk-score tools mostly judge your behavior in the background. Proof-of-work tools make your device do a small calculation. A game CAPTCHA is the visible kind where the task is play. Each has trade-offs for friction, accessibility, privacy and abuse resistance.
The W3C's note recommends offering more than one kind of challenge when an interactive test is needed. A game plus an alternative question follows that idea inside one widget.
The 18 games, by length
The shortest listed average is Tap in Order at 6 seconds. Pac-Man Lite, Penalty Kick and Asteroid Dodge list 8 seconds. Color Match, Stack It, Hoops and Duck Hunt list 10. Whack-a-Bot, Pipe Connect, Brick Breaker, Mini Golf Putt, Skee-Ball and Frogger Hop list 12. Connect 4, Fruit Sorter and Tetromino Drop list 15, and Maze Runner is the longest at 20. Each has an individual demo page.
When a game fits
A game fits when the visitor expects some play or when brand matters: gaming and community sites, sports and ticketing, retail with an arcade feel, and signup flows that want a friendly step. It fits less well on a payment page where any extra step costs sales, and it is the wrong tool when you need no visible challenge at all.
You can also run several games. If you own more than one, the widget shows a Switch game button, and visitors pick the one they like. Your site key, embed code and server-side verification stay the same.
Questions
How long does a game CAPTCHA take?
CaptchaKit lists an average play time for each game, from 6 seconds for Tap in Order to 20 seconds for Maze Runner.
How many games does CaptchaKit have?
18, including Connect 4, Pac-Man Lite, Whack-a-Bot, Color Match, Maze Runner, Fruit Sorter, Stack It, Tap in Order, Pipe Connect and Skee-Ball.
Can visitors switch games?
If you own more than one game, the widget shows a Switch game button that opens a tile view. The site key and verify code stay the same. You can turn it off in the dashboard.
Does the game run on my server?
No. The game code and completion logic are served from captchakit.com in an iframe.
Is a game CAPTCHA right for every form?
Not always. A visible game suits signups, logins, comments and community sites. If you want no visible step at all, choose an invisible tool.
Where can I try one?
Each game has a demo page, such as Connect 4 and Pipe Connect.
Is a game CAPTCHA the same as an image CAPTCHA?
No. An image CAPTCHA asks the visitor to recognize pictures. A game CAPTCHA asks them to finish a short game, and the result is checked by a signed token on your server.
Sources
- CaptchaKit documentation (checked 2026-10-17)
- W3C, Inaccessibility of CAPTCHA (checked 2026-10-17)
- OWASP OAT-009 CAPTCHA Defeat (checked 2026-10-17)
- CaptchaKit pricing (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.