Privacy Pass Protocol

Privacy Pass splits responsibility across four roles so that no single party knows everything about user's identity and activity. This page explains the information flow of the protocol. For who operates each role and the privacy properties this design provides, refer to Deployment Models.

As defined in RFC 9576, the flow runs across two protocols: issuance (obtaining a token) and redemption (using it for access).

                                 
    Origin              Client           Attester           Issuer 
                                 
                                                                  
       < Request                                       
                                                                  
        TokenChallenge >                                      
                                                                  
                            <== Attestation ==>                   
                                                                   
                             TokenRequest+Attestation Proof >
                                                                   [Verifies Attestation]
                            < TokenResponse 
                            [Finalises Token]
       < Request+Token 
                            
        200 OK >

Initial Request

1. The Client sends a request to the Origin.
2. The Origin responds with a token challenge. If the Client has no token to redeem, it begins the issuance protocol with an Issuer the Origin trusts.

Issuance Protocol

1. The issuance protocol begins with the Client completing a deployment-specific attestation process. This step is intentionally open-ended so different use cases can define their own attestation.
2. Once the Attester verifies the Client, the Client sends a blinded token requesta request to sign a masked version of the token, preventing the finalized version from being linked to the original requestto the Issuer, along with proof of attestation.
3. The Issuer checks the verification, signs the blinded token, and returns it. The Client finalises it to recover the Privacy Pass token, completing the issuance protocol.

Redemption Protocol

1. The interaction finishes with the redemption protocol, where the Client sends the token along with its original request back to the Origin.
2. The Origin verifies the signature and responds with 200 OK, granting access.

To run the complete issuance and redemption flow on your own machine no Cloudflare setup required see the local example in Getting started.

• RFC 9576: Privacy Pass Architecture
• RFC 9577: The Privacy Pass HTTP Authentication Scheme
• RFC 9578: Privacy Pass Issuance Protocols