Cloudflare works on quantum-safe Privacy Pass tokens to keep anonymous anti-abuse checks secure
In a research post published on November 6, Cloudflare explained how it plans to make Privacy Pass resistant to future quantum computers. Privacy Pass is the system of anonymous tokens that lets websites limit abuse without CAPTCHAs or accounts, and it is also used in Apple's iCloud Private Relay. Cloudflare is developing new schemes based on post-quantum signatures and has published its experimental code.
Read the original on Cloudflare Blog — The post-quantum future of web privacy ↗
Why it matters
Today these tokens rely on classic cryptography such as RSA and elliptic curves. A powerful quantum computer could forge them and bypass rate limits, so the protection behind many "no CAPTCHA" checks would stop working. Preparing the replacement now gives standards bodies time to review it.
What changes
- For developers
- The new tokens are much larger: Cloudflare's candidates need roughly 4 to 12 KB per redemption, compared with a few hundred bytes today, while each operation still takes only a few milliseconds. The code is on GitHub in the cloudflareresearch/vole-mole repository.
- For businesses
- Nothing changes yet: Cloudflare describes the work as research, with security proofs and more analysis of the underlying UOV signature scheme still needed before any deployment.
- For users
- For people browsing the web, the goal is to keep proving they are not a bot without solving puzzles or giving up their privacy, even after quantum computers arrive.
Sources
- Cloudflare Blog — The post-quantum future of web privacy ↗ blog.cloudflare.com Primary source
Summarized by AI from official sources on November 7, 2026. Spotted a mistake? Let us know. How it works