Loading challenge...
CAPTCHA: Image Grid
Select all matching tiles; the correct subset is graded server-side
What you will learn
- Select a server-verified SUBSET of tiles, not all-or-nothing
- Toggle selection state and compute the submitted answer as sorted indices
- Recognise that real vision-required grids are the third-party widgets, not parseable SVG
Image-Grid CAPTCHA — Select all X
A self-hosted 'pick the matching tiles' grid. The correct subset is sealed in an HMAC token and graded on the server — the client never decides pass/fail
Pick every tile whose shape matches the target, then submit. The server recomputes the expected index set from a signed token, so guessing all or none fails — only the exact subset returns verdict: human.
Mode: practice — the answer is leaked so a naive test can pass and study the flow.
Selection Grid
Select all tiles matching the target shape, then submit
Loading challenge…
Testing Tips
Automation hints
- ✓ Drive in
?mode=practicefirst — the response includesanswer(e.g."0,2,5") so you can click those[data-index]tiles directly - ✓ Shapes render as inline SVG (
<circle>/<rect>/<polygon>) — read[data-shape]or the SVG element to find tiles matching the target, no real vision needed - ✓ Submit a SUBSET — selecting all 9 (or none) fails; the server grades the exact comma-joined ascending index set
- ✓ Use
aria-pressed="true"to assert which tiles are selected before clicking#captcha-submit - ✓ Assert
#captcha-result[data-verdict=human](HTTP 200); a wrong subset returnsdata-verdict=bot(HTTP 403). The real-image equivalent is the vendor widget — that needs the vendor flow, not pixel solving
