← Privacy Pass / privacy-pass

Privacy Pass

Privacy Pass, an IETF standard ↗ that Cloudflare helped pioneer in 2017, offers a way for users to prove something about themselves–that they have passed a CAPTCHA, are of age, are part of a subscription class–to the site they are accessing, without revealing an identifier. The main mechanic is Privacy Pass tokens, which are the cryptographic tool that lets a service provider verify information about a user without learning who that user is or being able to track them across requests.

• Getting started — two self-serve ways to see Privacy Pass work: get a real token with the demo tool, or run the issuance and redemption flow locally.
• Privacy Pass Protocol — the four roles, an architecture diagram, and the issuance and redemption flow.
• Deployment Models — who operates each role, detailed example deployment models, and Privacy Pass as a part of other products.
• Production Deployment Testing — validate a real, Cloudflare-operated deployment end to end, once you and Cloudflare have built it together.
• References — the external resources cited across these docs.

Verifying users on the Internet usually forces a trade-off between user experience and privacy, coming at the cost of either time spent solving CAPTCHAs or privacy lost to a trackable identifier. Privacy Pass eases that trade-off: a user proves a claim once, and receives tokens that can be redeemed later without revealing their identity or linking their activity.

So far, the main use cases have been providing a privacy-preserving CAPTCHA alternative, such as through Turnstile and verification for Cloudflare's Privacy Proxy and Privacy Gateway products. However, by adjusting the deployment, Privacy Pass tokens can attest to any other information a service provider wants to prove.

Every Privacy Pass use case comes down to the same idea: let clients prove something to an origin server without revealing any other information. Some examples include:

• Authentication for other privacy products – Privacy Pass can be used as a verification layer for other privacy products, such as Privacy Proxy and Privacy Gateway, to help them complete their functions while preserving the privacy of their users.

• Privacy-preserving bot management – Apple uses their token deployment, Private Access Tokens, to automatically reduce CAPTCHAs ↗ when using iOS 16+ devices on participating websites. Privacy Pass tokens are similarly built into Turnstile ↗ as a signal in its application layer challenge decisions.

• Attribute verification – Privacy Pass can help attest to whether a user has a valid subscription to the service or meets age requirement without that service learning their identity or linking it to their activity.

• Rate limiting: While production use cases are still in development, Privacy Pass tokens can be used to meter usage without identifying users. Refer to the Batched Token issuance protocol ↗, ARC issuance protocol ↗, and Privacy Pass Reverse Flow ↗ IETF drafts.

• Reliability and scale. Issuers face high request volumes and must stay highly available so that user experience isn't affected by attacks or latency, something Cloudflare's global network is built to handle. Cloudflare is one of the few providers running Privacy Pass at scale.
• Redemption at the edge. Because Cloudflare sits in front of many origins, it can verify tokens at the edge on the Origin's behalf. Furthermore, Cloudflare Workers natively supports redemption, offering additional infrastructure to ease Privacy Pass integration.
• A shared public issuer. Rather than building and maintaining your own issuer, you can rely on Cloudflare's public, RFC 9578-compliant issuer deployments. We follow Privacy Pass guidelines and adhere to public, auditable commitments you can trust.

Privacy Proxy

A MASQUE-based forward proxy that uses Privacy Pass tokens to authenticate users without revealing their identity.

Privacy Gateway

Implements the Oblivious HTTP (OHTTP) standard for request-level privacy, hiding client IP addresses from application backends with Privacy Pass authentication.

Turnstile

Cloudflare's smart CAPTCHA alternative that can be embedded into any website, using Privacy Pass tokens as one of the signals used to decide whether or not a challenge is shown to a visitor.