proxypicker_ VERIFIED DATA

Privacy Pass Tracker

Home › Guides › Privacy Pass Tracker

✓ checked 13 October 2026 · source: IETF Datatracker (Privacy Pass working group) · method · caveats · download the data

Privacy Pass, the IETF working group that standardises anonymous tokens a site can accept in place of a CAPTCHA, has 3 published RFCs and 4 active drafts. Datatracker lists 27 Internet-Drafts in the group. Its next candidate standard, batched token issuance, is with the responsible Area Director, who asked for a revised draft on 20 September 2026. In July the group stopped work on its anonymous rate-limited credentials (ARC) drafts.

published RFCs 3active drafts 4revisions in the last 12 months 12

Headline numbers

  1. Three standards published on 13 June 2024: RFC 9576 (the architecture), RFC 9577 (the HTTP authentication scheme sites use to ask for and accept tokens) and RFC 9578 (the issuance protocols).
  2. 4 drafts are active. Batched tokens (revision 8, May 2026) went to the IESG in July and is in AD evaluation, the token-expiration extension is in working-group last call, and two drafts (public metadata and authentication-scheme extensions) are waiting for a chair go-ahead.
  3. Work on ARC stopped. On 22 July 2026 both ARC drafts were marked dead. The Datatracker note says: “The working group has been unable to develop an attractive version of ARC with post-quantum unlinkability.” The group would instead “focus on alternatives that can offer this property”.

Draft revisions per year

New Privacy Pass draft revisions per year20202020: 6620212021: 8820222022: 323220232023: 404020242024: 131320252025: 12122026 (to 13 Oct)2026: 99
New revisions of the 27 Privacy Pass Internet-Drafts by year. Pink: 2026 to 13 October. Source: IETF Datatracker.

Activity has slowed since the RFCs

120 draft revisions have been posted since 2020. The busiest year was 2023 (40), when the three core documents were finished; 2026 so far has 9. RFC 9577 says the scheme “can also be used by Origins to challenge Clients to present Privacy Pass tokens”, which is why it matters to sites deciding how to tell people from automated traffic.

Two other IETF efforts touch automated and proxied traffic: Web Bot Auth: Standards Tracker, on how bots identify themselves, and the MASQUE Tracker, on proxying over HTTP/3.

All 27 drafts

DraftTitleRevisionsLatest revisionStatus
draft-ietf-privacypass-expiration-extensionPrivacy Pass Token Expiration Extension115 May 2026Working-group last call
draft-ietf-privacypass-public-metadata-issuancePrivacy Pass Issuance Protocols with Public Metadata413 May 2026Waiting for WG chair go-ahead
draft-ietf-privacypass-auth-scheme-extensionsThe PrivateToken HTTP Authentication Scheme Extensions Parameter413 May 2026Waiting for WG chair go-ahead
draft-ietf-privacypass-batched-tokensBatched Token Issuance Protocol94 May 2026AD evaluation (revised draft needed)
draft-ietf-privacypass-arc-protocolPrivacy Pass Issuance Protocol for Anonymous Rate-Limited Credentials22 March 2026Dead WG document (expired)
draft-ietf-privacypass-arc-cryptoAnonymous Rate-Limited Credentials Cryptography22 March 2026Dead WG document (expired)
draft-yun-privacypass-arcPrivacy Pass Issuance Protocol for Anonymous Rate-Limited Credentials320 October 2025Replaced
draft-yun-privacypass-crypto-arcAnonymous Rate-Limited Credentials120 October 2025Replaced
draft-yun-cfrg-arcAnonymous Rate-Limited Credentials26 August 2025Replaced
draft-hendrickson-privacypass-expiration-extensionPrivacy Pass Token Expiration Extension424 January 2025Expired
draft-ietf-privacypass-rate-limit-tokensRate-Limited Token Issuance Protocol71 April 2024Expired
draft-wood-privacypass-auth-scheme-extensionsThe PrivateToken HTTP Authentication Scheme Extensions Parameter329 March 2024Replaced
draft-ietf-privacypass-consistency-mirrorChecking Resource Consistency with HTTP Mirrors130 January 2024Expired
draft-hendrickson-privacypass-public-metadataPublic Metadata Issuance425 November 2023Replaced
draft-group-privacypass-consistency-mirrorChecking Resource Consistency with HTTP Mirrors223 October 2023Replaced
draft-ietf-privacypass-auth-schemeThe Privacy Pass HTTP Authentication Scheme1623 October 2023Published as RFC 9577
draft-ietf-privacypass-protocolPrivacy Pass Issuance Protocol173 October 2023Published as RFC 9578
draft-ietf-privacypass-architectureThe Privacy Pass Architecture1725 September 2023Published as RFC 9576
draft-ietf-privacypass-key-consistencyKey Consistency and Discovery210 July 2023Expired
draft-robert-privacypass-batched-tokensBatched Token Issuance Protocol213 March 2023Replaced
draft-wood-key-consistencyKey Consistency and Discovery417 August 2022Replaced
draft-privacypass-rate-limit-tokensRate-Limited Token Issuance Protocol46 July 2022Replaced
draft-pauly-privacypass-auth-schemeThe Privacy Pass HTTP Authentication Scheme131 January 2022Replaced
draft-ietf-privacypass-http-apiPrivacy Pass HTTP API212 July 2021Replaced
draft-svaldez-pp-http-apiPrivacy Pass: HTTP API213 July 2020Replaced
draft-davidson-pp-protocolPrivacy Pass: The Protocol213 July 2020Replaced
draft-davidson-pp-architecturePrivacy Pass: Architectural Framework213 July 2020Replaced

Method

On 13 October 2026 we pulled the Privacy Pass group’s documents, states, revision events and document histories from the IETF Datatracker API. A revision is a new-revision event. Status combines Datatracker’s draft state with its IESG and working-group stream states. RFC dates are the Datatracker “published” events. A script recomputes every number on this page from the saved API responses.

Caveats

  • Draft counts include individual drafts later replaced by working-group versions (14 replaced, 6 expired, including the 2 dead ARC drafts), so the 27 drafts are not 27 separate proposals.
  • Revision counts measure editing activity, not progress or adoption. Deployment by browsers, operating systems or CAPTCHA providers isn’t tracked in Datatracker, and we didn’t measure it.
  • The group has no milestones listed in Datatracker.

Download the data

Cite as: ProxyPicker, “Privacy Pass Tracker: The IETF’s CAPTCHA-Alternative Tokens”, 13 October 2026, https://proxypicker.com/privacy-pass-tracker/. Data: IETF Datatracker.

Related: Web Bot Auth: Standards Tracker · MASQUE Tracker.

Press & data requests: email [email protected] for interviews, the raw data behind this page, or corrections. See also our contact page.