How anonymous credentials let you prove you're human online without a trackable identity or a fingerprint, and where Mozilla's new PACT proposal fits in.
Key Takeaways
- In mid-2026, Mozilla, Cloudflare, and Chrome sketched PACT (Private Access Control Tokens) at a W3C meeting — a way to prove you're a real human without handing a site a trackable identity.
- The underlying primitive is anonymous credentials: unlinkable, single-use tokens that prove a property (like "not a bot") without revealing who you are.
- Privacy Pass (RFC 9576) is the standardized foundation this builds on, already used to reduce CAPTCHA friction for some VPN and Tor users.
- PACT is a proposal, not a shipped standard — treat every specific here as forward-looking, not something you can test today.
- Cloudflare's Web Bot Auth applies the same cryptographic-identity idea to bots directly: signed requests instead of guessing from IP and User-Agent.
- Both trends point the same direction: replacing fragile fingerprint/IP heuristics with cryptographic proof, on both sides of the human/bot line.
The Problem: Proving You're Human Is Privacy-Hostile
Today, a site that wants to know "is this a real person?" has two blunt tools. It can interrupt you with a CAPTCHA, or it can quietly build a browser fingerprint from your canvas output, fonts, screen size, and dozens of other signals, then score how consistent and how common that fingerprint looks. Our guide to bot detection techniques covers how these signals get combined in practice.
Both approaches work, but both cost you something. CAPTCHAs are friction — solved by real users and by paid solving services alike. Fingerprinting works silently, but it does so by building a durable, trackable identity out of your device, which is exactly the kind of tracking privacy-conscious users and browsers try to shrink.
That tension — "prove you're legitimate" versus "don't build a profile of me" — is what anonymous credentials are designed to resolve.
What an Anonymous Credential Actually Is
An anonymous credential is a token that proves a property about you without revealing who you are or letting anyone link that proof to your other visits. Three design choices make this work:
- Unlinkability. Each token is used once and looks statistically indistinguishable from every other token issued, so a site (or a colluding pair of sites) can't connect two of your visits by comparing tokens.
- Issuer/origin separation. The party that vouches for you (the issuer) is architecturally separate from the site that checks the token (the origin, called the "relying party" in these designs). The issuer never learns which site you presented the token to, and the site never learns who issued it to you specifically.
- Proof without disclosure. The token proves a narrow claim — "a human passed a check recently" or "this client hasn't exceeded its rate limit" — not your identity, browser, or history.
The result is a credential that behaves like a stamped, anonymous ticket rather than a name tag: a site can trust it without being able to build a profile from it.
Privacy Pass: The Standardized Foundation
This isn't a new idea invented for the bot problem. Privacy Pass, standardized by the IETF as RFC 9576, already defines this issuer/origin/token architecture and is deployed today to let some VPN and Tor users skip repeated CAPTCHA challenges — the token proves "this client already passed a check" without re-exposing their IP or browsing pattern to the challenge provider each time.
PACT — which Mozilla, Cloudflare, and Chrome sketched together at a May 2026 W3C Community Group meeting, and which Mozilla wrote up in "PACT: Anonymous Credentials for the Web" — extends this foundation with stateful counters: a site can check that a client hasn't exceeded some threshold (say, a rate limit) without ever reading the counter's actual value or linking it across sessions. That's the piece that makes the Privacy Pass primitive useful for "the bot era," as Mozilla frames it — not just single yes/no checks, but ongoing, privacy-preserving rate and reputation signals.
It's worth being precise about status here: as of mid-2026, PACT is a W3C proposal being sketched by browser vendors, not a shipped API. No browser enforces it, no site can rely on it in production, and the details will likely change before (if) it standardizes. Treat this section as "where the conversation is heading," not "what you can deploy."
Real-World Deployment: Cloudflare's Cryptographic Bots
While PACT is still a sketch on the human side of the line, the bot side has moved faster. In 2026 Cloudflare rolled out Web Bot Auth, alongside pay-per-crawl and a default posture of blocking unverified AI crawlers — together part of an industry shift toward treating automated traffic as a first-class, cryptographically identified visitor rather than an anomaly to be inferred from IP ranges and User-Agent strings.
The mechanism is the mirror image of an anonymous credential: instead of a human proving "I am one of many, don't track me," a bot operator cryptographically signs its requests to prove "I am this specific, accountable crawler." A site can then verify the signature directly, rather than reconstructing a guess from IP reputation and network-layer signals. Both efforts — PACT for humans, Web Bot Auth for bots — are really the same architectural bet: replace fragile heuristics assembled from fingerprints, IPs, and behavioral guesswork with cryptographic proof of a specific, narrow claim.
What This Means for the Future of Bot Detection vs. Fingerprinting
If proposals like PACT mature, the honest framing is "a new option alongside fingerprinting," not "the end of fingerprinting." Fingerprint-based detection is deeply entrenched, works today without any standards process, and covers cases — like distinguishing a spoofed device from a real one — that a yes/no credential doesn't address. What a credential system changes is the cost of proving legitimacy: instead of a site building a permanent profile to make that judgment, it can accept a single-use, unlinkable proof and move on.
For everyday users, the practical takeaway right now is smaller than the standards discourse suggests: nothing changes in your browser today. What's worth doing is understanding what a site can currently observe about you, since that's the baseline these proposals are trying to improve on.
See What Sites Can Observe About You Today
Anonymous credentials are a proposal for tomorrow's web; fingerprinting and behavioral scoring are how sites tell humans from bots right now. You can see both sides of that on BrowserInsight: the bot detection tool shows the automation and consistency signals a detection stack scores, and the fingerprint check shows the full set of device signals a fingerprint is built from. For a broader look at how tools like VPNs fit — and don't fit — into this picture, see our comparison of privacy tools.
Frequently Asked Questions
Can I use PACT or anonymous credentials today?
No. As of mid-2026, PACT is a W3C proposal being discussed by Mozilla, Cloudflare, and Chrome — no browser ships it and no site can rely on it in production. Privacy Pass (RFC 9576), the older foundation it builds on, is deployed in limited contexts like CAPTCHA-skipping for some VPN and Tor traffic.
How is an anonymous credential different from a login or a cookie?
A login or cookie identifies you specifically and persists across visits, which is exactly what makes it trackable. An anonymous credential proves a narrow property — "a human passed a check" — using a token that's unlinkable to any other token you've used, so it can't be strung together into a profile the way a persistent ID can.
Does this replace browser fingerprinting?
Not currently, and not entirely even if it matures. Fingerprinting catches spoofing and inconsistency that a simple pass/fail credential doesn't address, and it works today without requiring browser vendors, issuers, and sites to all adopt a new standard. The realistic outcome is credentials handling some of the "is this a human" load alongside fingerprinting, not replacing it outright.
What is Web Bot Auth and how does it relate?
Web Bot Auth is Cloudflare's system for cryptographically signed bot requests — the bot-side counterpart to human-side anonymous credentials. Instead of a site guessing whether traffic is an automated crawler from IP ranges and User-Agent strings, a verified bot operator signs its requests directly, letting the site check a cryptographic proof instead of an inferred pattern.
