The neural network at play busting CAPTCHAs after only 15 minutes.

Software Engineer Shows CAPTCHA Defeat with Simple AI

Spam, phishing, data breaches, hacking attacks and other pernicious forms Internet fraud have become increasingly commonplace on the web over the past decades, spawning a vast shadowy industry of hackers employing increasingly sophisticated and often automated meanings of exploiting site vulnerabilities.


One simple and effective first line of defense against web-trawling hacker bots is the CAPTCHA, the commonplace and often frustrating check-in-the-boxes seen across the web where users have to prove that are indeed “not a robot” by identifying and typing  the correct answer to distorted images of words or scrambled symbols. By using CAPTCHA systems to control access to forums, email lists, shopping sites, and other prime targets for hacker bots and spammers, CAPTCHAs and similar systems provide a way for web developers to safeguard their sites.

However, it turns out that CAPTCHAs aren’t so good at weeding out the robots, at least not in their simplest forms. In fact, machine learning expert and software engineer Adam Geitgey shared a piece on Medium.com describing how  in only 15 minutes he built a neural network to defeat the widely-used WordPress plugin Really Simple CAPTCHA, a popular security tool among the platform’s plethora of sites.

‘Really Simple CAPTCHA’ in use.

Using the popular machine learning tools Python 3, OpenCV, Keras and TensorFlow, Geitgey gives a step-by-step guide to cracking the CAPTCHA using a convolutional neural network, a type of deep learning architecture popular in image recognition and other computer vision applications. While the human brain can readily identify that the image above spells “ZX7Z” with ease, a computer program trained strictly to read text can be thrown off by relatively simple deviations such as the tilting of the letters and other distortions found in common CAPTCHA systems. Geitgey’s aim is instead to build and train a neural network to “learn” how to read the altered images of letters and numbers. But first, the crucial ingredient: good data.

Geitgey used the plugin’s source code to randomly output 10,000 images of CAPTCHAs labeled with the image’s answer; while he notes that it might have been tempting at first blush to simply train the network on the seemingly simple dataset of scrambled CAPTCHA images and their expected answers, it would actually take longer than training the network to identify the individual characters in the CAPTCHAs, which is the method he outlines in the article. Instead of training the network to learn all of the randomized variations of the CAPTCHA and try to identify the entire 4-character answer from a single “look,” it’s simpler to train it to parse the CAPTCHA into each of its characters and identify them one at a time.

Using the tools outlined earlier, Geitgey then builds the following neural network and trains it to start cracking CAPTCHAs–all within 15 minutes!

A visual outline of the CNN (convolutional neural network) used...

…and the resultant product.

To read in detail the steps of how to code and train this network yourself, visit the original post. Needless to say, Geitgey’s example demonstrates not only the magic of deep learning in capable hands, but also the potential vulnerability of Really Simple CAPTCHA and other CAPTCHA systems that rely only on relatively simple-to-read characters. While more complex CAPTCHA systems that aren’t as vulnerable are already in use across the web–such as those you may have seen asking, for instance, to identify a subject in a selection of random images–even those can likely be solved with little difficulty by computer vision AI–such as Google’s Inception–which excel at image classification.

…Still easy fodder for neural networks.

So, have fifteen minutes and the required tools? See if you can follow Geitgey’s recipe.