Privacy Pass
Why it matters Sites want to keep out automated abuse, and the usual tools (puzzles, logins, tracking cookies) either annoy you or identify you. Privacy Pass offers a third way: you show a token proving that someone trusted checked you, and the site cannot tell which person you are or link your visits. You may already be using it without knowing.
The festival stamp
Imagine a festival where a guard at the main gate checks your ticket and stamps your hand with an ink that every stall recognises. At each stall you show the stamp and walk in. The stalls know you passed the gate, but the stamp is the same for everyone, so they cannot tell you apart or work out which stalls you visited. Privacy Pass is a digital version, with one twist: each token is used once, and the gate never sees which token it gave you.
Privacy Pass: a set of open standards (RFC 9576, 9577 and 9578, published in 2024) for anonymous tokens. A trusted party vouches for you once; sites later accept the tokens without learning who you are or linking your visits.
RFC: "Request for Comments", the numbered documents in which internet standards are published.
Four roles
- Client: your browser or device.
- Attester: checks something about you, such as that you solved a challenge once, or that you are using a genuine, unmodified device.
- Issuer: hands out tokens once the attester is satisfied.
- Origin: the website that asks for a token instead of showing you a puzzle.
The key ingredient: blinding
If the issuer simply signed a token and you showed it to a site, the two could compare notes and link you. So the token is blinded before signing.
Blind signature: a signature made on a message the signer cannot see. Picture a letter inside an envelope lined with carbon paper. The signer signs the outside, the signature goes through onto the letter, and you open the envelope later. The signer never saw the letter, so they cannot recognise it when it turns up.
The client makes a random token, wraps it with a blinding factor (much like the secret exponent in the PSI lesson), and sends it to be signed. It then removes the blinding factor, leaving a valid signature on a token the issuer has never seen. When an origin later checks the token, the issuer cannot match it to the signing request. RFC 9578 describes two ways to do this: one where only the issuer can check tokens, and one using blind RSA signatures that anyone with the public key can check.
What it really proves, and what it does not
A token proves exactly one thing: an issuer the site trusts, relying on some attester, vouched for this client. It does not prove you are human, it does not say who you are, and it does not say what the attester checked. The site trusts the issuer's judgement.
Privacy Pass is not free of trust, either. The attester and issuer learn that you asked for tokens. If they joined forces, or if an issuer used a different signing key for each user, tokens could become linkable again; the standards include rules against such key tricks. And because tokens are single-use, they can be rate-limited, which stops one client from flooding a site.
Where you meet it
Privacy Pass began in 2017 as a browser extension that let people solve one challenge and skip many later ones. Apple's Private Access Tokens, introduced in 2022, use the same design, with the device itself acting as the attester, so some sites can skip a puzzle for supported Apple devices (checked October 2026). Other services use it for rate limits and fraud checks.
A common misconception
"Anonymous tokens mean anyone can abuse the site." No: you only get tokens after an attester is satisfied, and each token works once. The site gives up knowing who you are, not knowing that someone checked you.
Recap
- Privacy Pass (RFC 9576 to 9578) lets a site accept proof that a trusted issuer vouched for you, without identifying or linking you.
- Blind signatures mean the issuer signs a token it never sees, so it cannot recognise it later.
- A token proves "someone trusted vouched", not "this is a human" or "this is Sam".
- Trust still sits with the attester and issuer, and single-use tokens allow rate limits.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.