A captcha token: the typed answer and the issued value

Session and account

A captcha token is the short value produced when a puzzle is answered, though the same word is used loosely for the puzzle itself.

The shape

Two separate objects share this name and only one of them is a string. The first is the puzzle: an image, a distorted word, a grid of tiles, something meant to be resolved by a person looking at it. The second is the value that a correct answer produces, which the far side records and checks again later. The puzzle has no shape in the sense this site uses. The value does.

Between them sits the field you type into, and that field has a shape of its own which you can read directly.

Typed answer: commonly four to eight characters; one fixed length per site, not a range that varies between attempts
Alphabet: a single alphabet, usually letters and digits together, sometimes digits alone. Never mixed with punctuation
Case: often accepted either way. Whether it is accepted either way is a decision made on the far side and is not visible in the string
Separator: none. The answer is one unbroken run, so a space inside it came from your keyboard or your clipboard
Issued value: an opaque run, longer than the typed answer, produced by the far side and rarely displayed
Life: counted in minutes from the moment the puzzle was issued, not from the moment you started typing

the field you type into, six characters of one alphabet
xxxxxx

the value the answer produces, one opaque run
(length here is thirty two, a site decision)
exampleexampleexampleexamplexxxx

what a space inside the typed answer looks like
xxx xxx

Placeholders, not values. See the alphabets page for what each character class allows.

The puzzle and the value are not the same object

When a rendered puzzle is hard to read, the difficulty lives in the picture. A zero drawn thin next to a capital O, a one that could be a lower case l, an eight distorted into a B: these are drawing problems. The stored value has no such ambiguity, because it is characters in a record, not ink on a curve.

This distinction is practical. If you cannot tell two glyphs apart, no amount of format knowledge helps you, because both readings are valid strings of the same length in the same alphabet. The format check passes for the wrong answer exactly as it passes for the right one.

Some sites cut the confusable characters out of the alphabet entirely, so no puzzle can ever contain a zero or a capital O. You can sometimes notice this after seeing a handful of puzzles, and it is the only case where the ambiguity becomes a shape fact rather than a rendering one.

How to check it by eye

Four things the answer box will tell you

Count the boxes, or read the character limit the field enforces. If the field stops accepting input at six, the answer is six characters and any reading of the picture that yields seven is wrong.
Type one character of each kind and watch what survives. A field that silently drops punctuation is telling you its alphabet without documenting it.
Look for a space in what you are about to submit. A captcha answer never contains one, so a space is always yours.
Check whether the puzzle redraws itself after a failure. A new picture means a new value was issued and the old one is finished, which changes what you are answering.

What a wrong shape means

The wrong shapes here are short: too few characters, too many, a character outside the alphabet, or whitespace that came along with a paste. Every one of them has the same boring explanation. Something between the picture and the field went astray, usually a misread glyph or a dropped keystroke.

None of it points outward. A wrong shaped answer is not evidence that the puzzle was fake, that the page was substituted, or that anybody interfered. It is evidence that a person read a deliberately degraded image and got a character wrong, which is the expected outcome some of the time and is the reason the puzzle can be retried.

The one wrong shape worth pausing over is a field that accepts far more characters than the puzzle could ever contain. That is a fact about the form, not about the answer, and it says only that the form was built loosely.

The short life is deliberate

A token of this kind exists to record that a step happened recently. Recently is the whole content of the claim, so the value is built to stop being accepted quickly. That is not a flaw being worked around, it is the function.

Which makes the opposite observation less interesting than it looks. If a value still works long after it was issued, you have observed a shape and a behaviour, and no honest conclusion follows. The window may simply be generous. Two clocks may disagree. The far side may keep the value alive for the length of a session on purpose. Nothing in the characters separates those cases, and this site tests none of them.

What a correct shape does not prove

Not that you read the picture correctly. A wrong answer of the right length passes every format rule there is.
Not that the value is still live. Expiry leaves no trace in the string; the run of characters is identical before and after.
Not that the puzzle came from where you believe it came from. That is a question about the host you are on, and it belongs to a host built from lookalike characters.
Not that case will be treated the way you assume. Two sites with identical answer formats can differ on this, and you cannot see which you are facing.
Not that the value is unique to you, or long enough to be hard to guess, or stored anywhere in particular. Length and alphabet are all the string exposes.

What this card is not

This is a format entry, so it does not discuss how puzzles are generated, how difficulty is tuned, or how any particular one behaves. It gives no method for getting past one and offers none. The value the far side sets afterwards is a session cookie, documented separately, and the clock driven cousin of this shape is a one time code.

A captcha token