Free Online CAPTCHA Generator
Create distorted text CAPTCHAs for testing, demos and mock-ups. Set the difficulty, character set, noise and distortion, then check your answer, listen to the characters or download the image as a PNG.
100% client-side · Drawn on a canvas · Web Crypto randomness · Nothing is stored or sent
These figures measure random guessing only. Programs that read the image with machine learning are the bigger risk, so a real site also needs expiry, single use and rate limits.
This tool is for testing and demos. A downloaded image is a fixed challenge, so do not use it as live protection.
How This CAPTCHA Generator Works
Each challenge is made in three steps. Random characters are picked with your browser’s cryptographic random number generator from an alphabet without look-alikes (no I, O, 0 or 1 in the default sets). Each character is then drawn on a canvas with its own rotation, slant, size, font and colour, the whole line is bent by a wave, and random curves and dots are laid on top. Only pixels reach the page: the answer is not in the HTML, in the image description or in any input box.
Checking behaves like a production challenge: it expires after two minutes, allows three attempts and can be solved once, after which a new CAPTCHA is generated. The strength figures count only the answers that are really different, so when the check ignores case, a and A count once. Text in an image is a weak barrier on its own against modern solvers, which is why expiry and rate limits matter as much as distortion.
Web Crypto Randomness
The characters and every visual wobble come from crypto.getRandomValues, never Math.random
Pixels, Not Text
The challenge is drawn on a canvas, so the answer is never in the page’s HTML
Exact Answer Odds
Entropy, possible answers and blind-guess odds, counted with case folded
Production-Style Checks
Two-minute expiry, three attempts and single use, like a real server-side challenge
PNG Without Libraries
The image is saved straight from the canvas, with no outside script
Nothing Stored
No history, no uploads and no network requests
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is a CAPTCHA?
A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge that is meant to be easy for a person and hard for a program, used to slow down automated sign-ups, spam and password guessing. This page creates the classic kind: distorted text that you read and type.
2. How do I use this CAPTCHA generator?
Pick a difficulty and character set, then read the characters in the picture and type them into the check box. Use Verify to test your answer, New CAPTCHA for another challenge, Play audio to hear the characters, and Download PNG to save the image. Developers can use Show answer to see the expected text while testing.
3. How is the CAPTCHA image made?
Characters are chosen with your browser’s cryptographic random number generator and drawn onto a canvas, each with its own rotation, slant, size, font and colour. The whole line is then bent by a wave and covered with random curves and dots. Because the result is only pixels, the answer is never written into the page’s HTML, so a script cannot simply read it.
4. What do the entropy and guess-odds figures mean?
Entropy is the length multiplied by log2 of the number of different answers each position can have. When the check ignores case, a and A count as one, so the figure uses the case-folded alphabet. Blind-guess odds show the chance that a program guessing at random passes within the three allowed attempts. These figures measure guessing only: real attacks usually read the image with machine learning instead.
5. Why does the default character set use capital letters and digits only?
The default check ignores case, so mixing upper and lower case adds nothing to the strength and only makes the picture harder to read. The default alphabet also leaves out I, O, 0 and 1, which are easy to confuse. Choose the mixed-case set if you want a case-sensitive check, which switches on automatically.
6. What do the timer and attempt limits do?
They copy how a server-side CAPTCHA should behave. A challenge expires after two minutes, allows three attempts, and can be solved only once. After a wrong third try or an expiry, a new CAPTCHA is generated, so an attacker cannot keep guessing at the same image.
7. Can I use the generated CAPTCHAs on my website?
Not as real protection. A downloaded image is a fixed challenge with a fixed answer that anyone can copy and replay, and modern machine-learning solvers read distorted text well. Use the images for testing, demos, mock-ups and training. For a live site, generate and check challenges on the server with expiry, single use and rate limits, or use a managed service such as Cloudflare Turnstile, hCaptcha or Google reCAPTCHA.
8. What makes a good CAPTCHA?
It should be easy for people and costly for bots, offer more than one way to pass (such as audio) so it does not lock out users, avoid trivia or cultural knowledge, expire quickly, work only once and be rate-limited on the server. Visual distortion alone is not enough, because it is the part that machine learning is best at defeating.
9. Is my data sent or stored anywhere?
No. The CAPTCHA is created and checked on your device, the page’s content security policy blocks outgoing network requests, no outside scripts are loaded, and nothing you type is saved. The PNG is created straight from the canvas in your browser.