Live: www.kilocaptcha.click
KILO-CAPTCHA is a 5-stage sequential CAPTCHA gauntlet designed to prove you're human through the most absurd, over-complicated, and unnecessary challenges ever put into a verification system.
While AI models can now solve reCAPTCHA, identify traffic lights, and click fire hydrants with superhuman accuracy, they cannot scream into a microphone, draw imperfect circles, chase fleeing buttons, hold precise timing, or memorize shuffling sequences. KILO-CAPTCHA exploits this gap with five multi-modal challenges that require distinctly human capabilities: vocalization, motor control, spatial reasoning, timing, and memory.
Challenge: Scream into your microphone loud enough to exceed a 70% volume threshold for 1 full second.
How it works: Uses the Web Audio API (getUserMedia, AnalyserNode) to capture real-time microphone input. A visual meter shows volume level. The user must sustain a loud-enough vocalization for a continuous second. If volume drops below threshold, the progress resets.
Why it works: Bots don't have lungs. Even text-to-speech systems produce consistent, measured output that can be calibrated against. A genuine human scream has unpredictable harmonic content and natural volume fluctuation.
Browser API: navigator.mediaDevices.getUserMedia(), AudioContext, AnalyserNode
Challenge: Draw a freehand circle on a canvas. Not too perfect (bot), not too sloppy (also bot). The sweet spot is "beautifully imperfect."
How it works: Canvas 2D API captures mouse/touch coordinates as the user draws. The system calculates the centroid, computes radius variance (coefficient of variation), and checks path closure. Scoring uses a bell curve: CV between 0.04-0.08 scores highest (100), while near-perfect circles (CV < 0.02) are flagged as suspicious (30).
Scoring tiers:
| CV Range | Score | Feedback |
|---|---|---|
| < 0.02 | 30 | "Suspiciously perfect. BOTS draw like that." |
| 0.02-0.04 | 70 | "Almost too perfect... but human tremor saves you." |
| 0.04-0.08 | 100 | "Beautifully imperfect. Peak humanity. chef's kiss" |
| 0.08-0.15 | 80 | "A bit wobbly. Too much coffee? Acceptable." |
| 0.15-0.25 | 50 | "That's... an amoeba. But you tried." |
| > 0.25 | 20 | "My grandmother draws better circles on a rollercoaster." |
Unclosed paths (closure ratio > 0.5) incur a -30 penalty.
Why it works: Computer-drawn circles have near-zero variance. Human hands produce characteristic tremor patterns. The anti-perfection scoring catches plotter bots while rewarding genuine human motor imperfection.
Browser API: Canvas 2D, Mouse/Touch Events
Challenge: Click a "VERIFY" button that physically runs away from your cursor. Catch the real one (1 real + 4 decoys) 3 times. It gets harder with each catch.
How it works: A requestAnimationFrame game loop tracks cursor position relative to the button. The button uses predictive fleeing — it analyzes your cursor velocity from the last 20 position samples and flees from your predicted intercept point, not your current position. Random jitter adds unpredictability. Wall bouncing uses elastic collision physics.
Escalation mechanics (per catch):
- Arena shrinks 8% per catch (minimum 300x200px)
- Speed increases (+1.8 base, +2.5 max speed per catch)
- Buttons scale down proportionally with arena
- Catch 2: Screen blackout flash (400ms) + "RELOCATING" warning
- Teleport: Real button swaps position with a random decoy, all decoys reshuffle
- Taunt escalation: 4 escalating taunt pools with phrases like "FINAL ROUND. MAXIMUM EVASION."
- Smoke trails follow the real button
Time-based scoring:
| Time | Score |
|---|---|
| ≤ 15s | 100 |
| 15-45s | 100 → 75 (linear) |
| 45-90s | 50 → 10 (linear) |
| > 90s | 10 |
Decoy physics: All 4 decoys use identical flee AI as the real button. They look identical (same "VERIFY" text, same pink border). Only the real button increments the catch counter when clicked.
Why it works: The combination of predictive AI, random jitter, elastic bouncing, arena shrinking, and teleportation creates a chaotic system that's extremely difficult for automated click-targeting. The 5 identical buttons with active flee AI make simple "find and click" automation impossible.
Browser API: Mouse Events, Touch Events, DOM manipulation, requestAnimationFrame
Challenge: Press and hold a circle for exactly 5 seconds. No timer. No visual feedback beyond a spinning ring. The success window is 5.0s to 5.5s. Too early or too late = instant fail.
How it works: performance.now() timestamps the mousedown and mouseup events. The elapsed time is compared against the success window. A spinning ring animation runs as the only visual indicator — but it provides no timing information (it spins at constant speed regardless of how long you've held).
Scoring: Based on proximity to the sweet spot (5.25s):
- Dead center (5.25s): 100 points
- Edge of window (5.0s or 5.5s): 80 points
- Linear interpolation between
Fail conditions:
- Released < 5.0s: "Released too early. Patience is a virtue."
- Held > 7.0s: "Held too long! The window was 5.0-5.5 seconds." (auto-fail timeout)
Why it works: Bots can time things to the millisecond. The challenge rewards human timing imprecision — the "sweet spot" is narrow enough that natural human variance (±0.25s) clusters around the target. Overthinking it leads to holding too long. The 2.5-second spinning ring animation serves as a subtle time anchor but doesn't give away the exact duration.
Browser API: Mouse/Touch Events, performance.now()
Challenge: Watch a sequence of colored buttons flash, then repeat it. After each round, all 4 buttons shuffle positions. Remember by color, not location. 6 rounds. One mistake = fail.
How it works: 4 colored buttons (Red, Green, Blue, Yellow) are placed randomly in an arena with non-overlapping positions. Each round, a sequence plays (buttons light up one at a time). The user must click the buttons in the same order. After completing a round, the buttons shuffle to new positions before the next round begins.
Round progression:
| Round | Sequence Length |
|---|---|
| 1 | 3 items |
| 2 | 5 items |
| 3 | 7 items |
| 4 | 10 items |
| 5 | 13 items |
| 6 | 16 items |
Position algorithm: Uses collision detection with 200 random placement attempts per button. Falls back to a 2x2 grid with random jitter if collision detection fails. Minimum 10px gap between buttons.
Playback speed: 500ms per item for sequences ≤ 10 items, 400ms for longer sequences.
Scoring: Binary — complete all 6 rounds = 100 points. Fail at any point = score based on rounds survived: Math.round((completedRounds / 6) * 100).
Why it works: The position shuffling forces memory by color association rather than spatial location. Each round builds on the previous sequence (it's cumulative, not fresh). By round 6, the user must recall 16 items in sequence — well beyond typical working memory capacity (7±2 items) without chunking strategies. The shuffling prevents "muscle memory" strategies.
Browser API: Mouse/Touch Events, DOM manipulation, CSS transitions
worstcaptcha-cloud/
├── index.html # Single-file SPA (HTML + CSS + JS, ~1860 lines)
├── vercel.json # Vercel static deployment config
├── BRAINSTORM_REPORT.md # Research & concept evaluation (10 concepts)
└── README.md # This file
- Single-file architecture: All HTML, CSS, and JavaScript in one
index.htmlfile. No build step, no dependencies, no framework. Deploy as static files. - Zero dependencies: No CDN imports, no npm packages. Everything runs from a single file.
- No backend required: All challenge logic runs client-side using browser APIs. The "verification" is purely theatrical — there's no server to report to.
- Proper cleanup: Each stage registers event listeners and animation frames, with a
state.cleanupfunction that properly removes them when transitioning between stages. This prevents memory leaks and cross-stage interference. - Progressive disclosure: Landing page features a reCAPTCHA v2 clone (306x78px) with real Google logo as base64 PNG. Clicking the checkbox shows "Verification failed. Starting gauntlet..." before transitioning to Stage 1.
- Inter-stage transitions: 2-second screens showing stage name, score (0-100%), quality label (EXCELLENT/PASSED/BARELY), and preview of next stage.
- Fail & retry: Each stage has a fail overlay with contextual failure message and "Retry This Stage" button that properly re-initializes the stage.
- Responsive design: CSS
clamp()for typography,min()for canvas sizing, touch event support throughout. Mobile-optimized at@media(max-width:600px).
| API | Stage | Purpose |
|---|---|---|
navigator.mediaDevices.getUserMedia() |
Scream | Microphone access |
AudioContext + AnalyserNode |
Scream | Real-time FFT volume analysis |
Canvas 2D API (getContext('2d')) |
Circle | Drawing + circle analysis |
| Canvas drawing methods | Circle | arc(), beginPath(), stroke(), fill() |
requestAnimationFrame |
Chase, Memory | Game physics loop, animation |
performance.now() |
Hold, Chase | Precision timing (millisecond) |
Mouse Events (mousedown, mousemove, mouseup) |
All | Desktop input |
Touch Events (touchstart, touchmove, touchend) |
All | Mobile input |
setTimeout / setInterval |
Memory, Chase | Sequence playback, delayed actions |
DOM Manipulation (createElement, classList) |
All | Dynamic UI elements |
| CSS Transitions | Memory | Button position shuffling |
| CSS Animations | Landing, Chase | Title gradient, glitch, screen shake |
Each stage awards 0-100 points. The final score is a percentage of the maximum possible (500 points). Score tiers:
| Score | Rating | Color |
|---|---|---|
| 90-100% | CERTIFIED HUMAN | Green |
| 70-89% | PROBABLY HUMAN | Blue |
| 50-69% | SUSPICIOUSLY HUMAN | Yellow |
| 30-49% | POSSIBLY A TOASTER | Purple |
| 0-29% | DEFINITELY A BOT | Pink |
CAPTCHAs are broken. AI broke them. We made something worse.
Traditional CAPTCHAs ask you to click traffic lights, type distorted text, or identify crosswalks. AI can do all of that better than you can. The arms race is over, and the machines won.
KILO-CAPTCHA is the nuclear option. Five challenges that no AI can solve, because they require capabilities that only biological organisms possess:
- Lungs (Stage 1: Scream into your mic)
- Hands (Stage 2: Draw a humanly-imperfect circle)
- Reflexes (Stage 3: Chase a fleeing button with predictive AI)
- Patience (Stage 4: Hold for exactly 5 seconds)
- Memory (Stage 5: Recall a 16-item sequence with shuffling positions)
| Feature | reCAPTCHA v3 | hCaptcha | KILO-CAPTCHA |
|---|---|---|---|
| AI-proof | No | No | Yes |
| User enjoyment | None | None | Questionable |
| Uses microphone | No | No | Yes |
| Makes users scream | No | No | Yes |
| Existential dread | Minimal | Minimal | Maximum |
| Time to complete | 0.5s | 2s | 45-90s |
| Blocks bots | Sometimes | Sometimes | Definitely |
| Also blocks users | Sometimes | Sometimes | Also definitely |
| Predictive AI | No | No | Yes (flee physics) |
| Memory test | No | No | Yes (16-item recall) |
- Login pages where you want users to question their life choices
- E-commerce checkout where you want to reduce conversion rates by 90%
- Government websites where suffering is the point
- Comment sections that nobody should be allowed to post in
- Any website where security matters more than user retention (all of them)
"I screamed into my microphone at 2 AM and my roommate called the police. 10/10 security." — Anonymous User
"I've been trying to draw a circle for 20 minutes. I failed the CAPTCHA but I learned something about myself." — Reddit User
"Our bot detection rate went from 60% to 100%. Our user retention went from 80% to 3%. We consider this a win." — CTO, Fortune 500 Company
"Finally, a CAPTCHA that respects the fact that humans are chaotic, impatient, and fidgety." — Security Researcher
"The Memory stage broke me. I got to round 5 three times. The buttons keep moving. I am not okay." — QA Tester
Q: Can AI actually solve this? A: Stage 1 requires a microphone. Stage 2 requires motor imperfection. Stage 3 requires real-time spatial reasoning against predictive AI. Stage 4 requires timing variance. Stage 5 requires 16-item working memory with position shuffling. Each stage attacks a different modality. To solve all five, an AI would need lungs, imperfect hands, predictive reflexes, and a hippocampus.
Q: Isn't this terrible UX? A: That's the point. The worst CAPTCHA is also the most secure. Security and usability have always been inversely proportional. We just took that to its logical extreme.
Q: Can I use this in production? A: You can. You shouldn't. But you can.
Q: What if I don't have a microphone? A: The scream stage requires microphone access. Get a microphone or accept your fate as a suspected bot.
Q: How does the Chase button know where I'm going? A: It tracks your cursor velocity over the last 20 position samples and predicts your intercept point. It flees from where you'll be, not where you are. It's smarter than it looks. Or you're worse than you think.
Q: The Memory stage is impossible. A: It's not. Chunk the sequence into groups. Or develop a musical memory. Or accept that you might be a toaster.
Q: Is this open source? A: It's a single HTML file. You can view-source. That's as open as it gets.
MIT — Use it, fork it, make it worse.
"The best CAPTCHA is the one that makes both bots AND humans suffer equally."