# Design a CAPTCHA service like reCAPTCHA: system design interview question

> High-volume human checks with low user effort, single-use proofs, and strict customer boundaries.

Source: https://sysround.com/questions/design-captcha-service-like-recaptcha
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a CAPTCHA service that websites use to distinguish humans from automated clients. It must support high request volumes with little user effort. The service must prevent challenge replay."

## What to clarify first

- Traffic
- Read:write mix
- Customer integration
- User effort
- Latency
- Lifetime and attempts
- Lost responses and retries
- Consistency and availability
- Location and durability
- Exclusions and privacy

## Scope of a strong answer

Core requirements:

- Issue challenges for a customer site and action
- Check answers and issue short-lived proofs
- Verify each proof for one protected operation
- Control automated abuse and unnecessary user effort

Usually out of scope:

- Train new challenge or risk models
- Replace customer authentication or fraud checks
- Guarantee that every automated client fails

## What interviewers probe

### Challenge and proof lifetime

Attackers can submit answers and proofs in parallel. A valid signature does not show whether an earlier request consumed the proof.

### Lost responses and retries

A lost response makes a retry resemble replay. The service must preserve a successful result beyond proof expiry without permitting another operation.

### Attacker-generated load

Attackers can create expensive work without solving challenges. Stronger challenges can also increase cost and reject legitimate users.

### Customer boundaries

A public site key permits browser access but cannot authorize server verification. Each proof must remain limited to its customer and action.

## Common mistakes

- Treats a valid signature as a single-use guarantee.
- Omits customer and action checks during verification.
- Rejects safe retries after proof expiry or lets retries authorize another operation.
- Trusts browser signals as facts.
- Focuses on puzzle difficulty and ignores user effort or accessibility.
- Uses stale replicas for proof consumption during a fault.

## The bar by level

- **Senior:** Defines safe retries beyond proof expiry and enforces customer boundaries. Handles concurrent answers, lost responses, zone failures, and attacker-created load. Measures user effort.
- **Staff+:** Defines regional authority and the customer operation contract. Resolves receipt retention, key retention, failover, durability, and latency trade-offs. Sets measurable abuse and privacy limits.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=captcha-service


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.