[zomgwtfbbq]

I prefer using captcha rather than using sleep and till now it has proven to be an effective measure to prevent bruteforcing

It's effective but not user friendly.

I use it in a way that form displays captcha if you have wrong password 5 consecutive times and then again after 5 times. So it makes it secure and friendly

Good decision. I've seen it a lot that after one or two times you'll have to solve the captcha every single time which is highly annoying.