The pp-browser-extension repository is Cloudflare's implementation of the Privacy Pass protocol client for web browsers, written in TypeScript. Named Silk, this browser extension provides users with unlinkable cryptographic tokens that enable privacy-preserving authentication without revealing user identity to service providers. The extension is compliant with IETF draft-ietf-privacypass-protocol v11 and is available for installation on Chrome, Firefox, and Edge through official browser extension stores, with source code available for manual compilation and installation.
The extension implements support for multiple token types as defined by the Privacy Pass specification. Public-verifiable tokens using Blind-RSA are fully supported and operational, while private-verifiable tokens using VOPRF, batched tokens, and rate-limited tokens remain under development. The core functionality operates through a challenge-response mechanism where websites request Privacy Pass tokens, prompting the extension to automatically request users to complete an associated challenge. Upon successful challenge completion, users receive a single token that can be used for future authentication without repeating the challenge process.
The architecture distinguishes between Attesters and Issuers, concepts introduced in 2023 when the extension updated to Privacy Pass Protocol draft 16 and refactored its cryptographic components into a dedicated library at cloudflare/privacypass-ts. Currently, Cloudflare Research with Turnstile serves as the primary attester, though the extension supports custom attesters that implement the cloudflare/pp-attester API, allowing service operators to roll out their own attestation methods. Users can configure multiple attesters with priority ordering through the extension options.
The repository shows moderate but consistent activity according to GitGenius tracking data. Across nine tracked issues and pull requests, the median response latency was 403.2 hours with a mean of 3032.5 hours, indicating variable response times. The most active contributors tracked include jelabarre59 and thibmeu with two events each, and CoffeeShifter with one event. Enhancement requests represent the most active issue label category. The repository shares contributors with microsoft/vscode, twbs/bootstrap, and travis-ci/travis-ci, suggesting cross-project involvement from the development team.
The extension addresses browser-specific limitations through innovative technical solutions. Chrome's restrictions on request blocking prompted the development of a client-side replay API that allows websites to orchestrate token retrieval without blocking requests. This mechanism uses a dedicated non-resolving domain for extension queries and implements a pull-based status checking system using data URLs, preventing DNS resolution and interference from other extensions. The extension automatically adds Private-Token-Client-Replay headers containing request IDs to enable websites to query token retrieval status and replay requests once tokens are obtained.
The project maintains comprehensive documentation covering installation procedures for different browsers, source compilation instructions, and manual extension loading processes. Known issues are documented, including conflicts with extensions that modify user-agent headers or request headers, and the extension provides detailed FAQs addressing user concerns about local storage clearing and attestation method configuration. The Privacy Pass protocol itself has a substantial history, originating from 2018 research published at PoPETS and progressing through multiple versions, with the IETF establishing a dedicated working group in 2020 to standardize the protocol. The extension represents the practical implementation of this standardization effort, bringing privacy-preserving authentication capabilities to mainstream browser users.
