Privacy Pass

Protocolo de Identidad

A privacy-preserving authorization protocol that lets a client prove it has passed some check, such as solving a challenge or being a legitimate user of a device, without being tracked across requests. A server issues tokens that are cryptographically blinded, so that when a token is later redeemed the issuer cannot link it to the issuance. It is now an IETF standards-track family: RFC 9576 describes the architecture, RFC 9577 the HTTP authentication scheme, and RFC 9578 the issuance protocols (published June 2024). The original deployment was a browser extension that let people skip CAPTCHA challenges at sites behind Cloudflare .

Estándar Abierto

Enlaces

Visitar Sitio Web Ver esta herramienta en el grafo Sugerir una corrección

Detalles

Licencia

Open source: the original extension and server code are on the project's GitHub pages; the standards are IETF RFCs. https://github.com/privacypass; https://github.com/ietf-wg-privacypass/base-drafts

Estado de Desarrollo 🟢 Activo

Propietario

IETF Privacy Pass Working Group (standards); the RFC authors include people from Cloudflare, Fastly, Apple, Brave Software and NOVA LINCS (Universidade NOVA de Lisboa)

Órgano de Gobierno

IETF Privacy Pass Working Group (Internet Engineering Task Force)

Órgano de Gobierno - Lista

Internet Engineering Task Force

País

International (IETF working group; authors across several organisations and countries)

Año de Inicio 2017

Stack

Verifiable, oblivious pseudorandom functions (VOPRFs) over elliptic curves in the original protocol; the standardised issuance protocols (RFC 9578) define two token types, VOPRF (P-384, SHA-384) and Blind RSA (2048-bit); HTTP authentication scheme

Financiamiento Not stated by the project.

Última Investigación 29 oct 2026

Vista de topología

Esta herramienta en el centro y lo que se relaciona directamente con ella. Cada línea nombra el tipo de relación.

Abrir en el Explorador de grafo

Dominios de Caso de Uso

Identidad y Confianza

Capacidades

Prueba de humanidad

Divulgación contextual

Protocolo de Identidad Atributos

Orígenes

Reduce the burden of internet challenges (CAPTCHAs) for users, especially those on shared or anonymising networks, by letting them redeem blindly signed tokens anonymously; standardised through the IETF to support wider use cases such as device attestation

Base de Datos

N/A

Lenguaje de Consulta

N/A

Formatos de Datos

Tokens carried in an HTTP Authorization header with its own authentication scheme; token challenge and token structures defined in RFC 9577; issuance request and response structures in RFC 9578

Soporte Móvil

Via platform implementations that adopted the standard (the cited sources name no specific mobile client beyond the protocol authors' employers)

Soporte Web

Yes: browser extension and an HTTP authentication scheme

Aplicaciones Nativas

Library and platform-level; the browser extension is the project's own client

Términos

Free and open: IETF RFCs and open-source reference code

Fondos

Not stated by the project.

Basado En

VOPRFs and blind RSA signatures; the RFCs reference the original Privacy Pass work and related IETF cryptographic standards

Órgano de Gobierno - Lista

Internet Engineering Task Force

Permisos

Origins choose which issuers to trust; clients choose which tokens to present

Autenticación e Identidad

No identity is revealed: a token proves only that the issuer's checks were passed; issuers and attesters decide what that means

Modelo de Almacenamiento

Clients store unspent tokens locally; issuers and origins keep spent-token state to prevent reuse

Interoperabilidad

A common HTTP scheme and issuance protocols let any compliant client, attester, issuer and origin interoperate

Portabilidad de Datos

Tokens are bearer instruments held by the client and redeemable at any origin that accepts that issuer; they are not portable between issuers

Gobernanza y Toma de Decisiones

IETF working-group consensus process, with the architecture, authentication scheme and issuance protocols as separate documents

Madurez del Protocolo / Estandarización

IETF standards track: RFC 9577 and RFC 9578 are Standards Track and RFC 9576 is Informational, all published June 2024

Estándares de Identidad

IETF RFCs 9576, 9577 and 9578; not a W3C DID or Verifiable Credentials scheme

Métodos DID Soportados

N/A

Gestión de Claves

The issuer holds a signing key and publishes the public key; clients hold unspent tokens; the architecture discusses key rotation and issuer directories

Tipos de Credenciales

Anonymous bearer tokens bound to a challenge; not identity credentials

Método de Verificación

The origin verifies the token against the issuer's public key and rejects reuse

Funciones de Privacidad

Unlinkability between issuance and redemption through blinding; the architecture discusses the remaining risks (for example from small anonymity sets and colluding parties)

Métodos de Autenticación

Blind-signed tokens redeemed over an HTTP Authorization header

Mecanismo de Revocación

Not a revocation model: tokens are single-use and expire by issuer key rotation

Tipos de Agentes Soportados

Clients (people and devices), attesters, issuers and origins

Tipos de Billetera/Cliente

Browsers and other HTTP clients; the original extension

Mecanismos de Recuperación

N/A: tokens are disposable

Cumplimiento / Regulaciones

Not stated by the project.

Protocolos de Intercambio de Credenciales

HTTP authentication scheme for redemption (RFC 9577) and issuance protocols (RFC 9578)

Marco de Confianza

Trust in issuers and attesters chosen by the origin; the architecture requires them to be separable to protect privacy

Modelo de Costos

Free to use; costs fall on the issuer and attester

Resistencia a la Censura

Low to moderate: issuance depends on issuers that a few large operators run today

Relaciones

Cómo se conecta esta herramienta con otras herramientas y organizaciones, según relaciones revisadas por el responsable de datos de OpenHaven. Describen cómo se conectan los proyectos, no su calidad.

Administrado por: Internet Engineering Task Force
Alojado en: Internet Engineering Task Force
Estandarizado en: Internet Engineering Task Force