CAPTCHA: Image Grid

Select all matching tiles; the correct subset is graded server-side

What you will learn

Select a server-verified SUBSET of tiles, not all-or-nothing
Toggle selection state and compute the submitted answer as sorted indices
Recognise that real vision-required grids are the third-party widgets, not parseable SVG

Image-Grid CAPTCHA — Select all X

A self-hosted 'pick the matching tiles' grid. The correct subset is sealed in an HMAC token and graded on the server — the client never decides pass/fail

Pick every tile whose shape matches the target, then submit. The server recomputes the expected index set from a signed token, so guessing all or none fails — only the exact subset returns verdict: human.

Mode: practice — the answer is leaked so a naive test can pass and study the flow.

Selection Grid

Select all tiles matching the target shape, then submit

Loading challenge…

Testing Tips

Automation hints

✓ Drive in ?mode=practice first — the response includes answer (e.g. "0,2,5") so you can click those [data-index] tiles directly
✓ Shapes render as inline SVG (<circle>/<rect>/<polygon>) — read [data-shape] or the SVG element to find tiles matching the target, no real vision needed
✓ Submit a SUBSET — selecting all 9 (or none) fails; the server grades the exact comma-joined ascending index set
✓ Use aria-pressed="true" to assert which tiles are selected before clicking #captcha-submit
✓ Assert #captcha-result[data-verdict=human] (HTTP 200); a wrong subset returns data-verdict=bot (HTTP 403). The real-image equivalent is the vendor widget — that needs the vendor flow, not pixel solving

Related Challenges

Image-Grid CAPTCHA — Select all X

A self-hosted 'pick the matching tiles' grid. The correct subset is sealed in an HMAC token and graded on the server — the client never decides pass/fail

Mode: practice — the answer is leaked so a naive test can pass and study the flow.

Testing Tips

Automation hints

✓ Drive in ?mode=practice first — the response includes answer (e.g. "0,2,5") so you can click those [data-index] tiles directly
✓ Shapes render as inline SVG (<circle>/<rect>/<polygon>) — read [data-shape] or the SVG element to find tiles matching the target, no real vision needed
✓ Submit a SUBSET — selecting all 9 (or none) fails; the server grades the exact comma-joined ascending index set
✓ Use aria-pressed="true" to assert which tiles are selected before clicking #captcha-submit
✓ Assert #captcha-result[data-verdict=human] (HTTP 200); a wrong subset returns data-verdict=bot (HTTP 403). The real-image equivalent is the vendor widget — that needs the vendor flow, not pixel solving

CAPTCHA: Image Grid

What you will learn

Image-Grid CAPTCHA — Select all X

Selection Grid

Testing Tips

Timer

Need Help?

Related Challenges

iFrames

Shadow DOM

Drag & Drop

CAPTCHA: Image Grid

What you will learn

Image-Grid CAPTCHA — Select all X

Selection Grid

Testing Tips

Timer

Need Help?

Related Challenges

iFrames

Shadow DOM

Drag & Drop