A fake CAPTCHA lets you refresh three times to escape, or scan a QR code for a rickroll

A QR code inside a verification box can look like the next official step in getting past a website’s defenses. ricKaptcha uses that expectation to send the visitor to a Rickroll. The checkbox has acquired musical taste, which is more than can be said for most forms.

The repository describes a reCAPTCHA-like interface for the prank. Its demo code supplies the same video URL to desktop and mobile examples. That makes the destination explicit in the source. Nothing about the panel’s familiar border establishes that the service it resembles is actually involved.

The implementation gives the desktop visitor a QR code generated from the supplied address. The mobile template substitutes a button that opens the address in another tab. Both routes are ways to follow a link, dressed in the language and visual arrangement of a verification task. A different device changes the route without changing the underlying destination.

The library source also supplies an unusually revealing definition of success. Its refresh counter reaches five, resolves the returned promise and displays a verified status. The example page then reveals its content. No observation about the visitor’s humanity is required for that particular result.

That is a useful little demonstration of the difference between an indicator and the check it is supposed to represent. A green symbol can be drawn by ordinary page code. A security decision needs a trusted implementation and a meaningful condition behind the symbol. The browser can make a badge look reassuring without making its conclusion true.

The joke does not establish a flaw in a real CAPTCHA service. It imitates an interface and uses that imitation as the setup. Keeping that distinction clear lets the source remain funny without turning it into a claim that a deployed service has been bypassed. The fake panel is doing exactly what its author arranged for it to do.

For a visitor, the transferable habit is checking where a request leads before treating its appearance as authority. A QR code is an address in another form. Moving that address onto a phone does not make the destination more trustworthy, even when the page says the move is part of a secure linking process.

For a developer, reading the tiny demo beside the larger interface code is the enjoyable part. The destination, the display template and the condition that reveals the page are separate pieces. Together they can produce a convincing-looking ritual whose actual purpose is a joke. You can inspect the source before your camera gets invited to the chorus.

Humanity confirmed. Musical judgment pending.