Cloudflare just convinced the makers of Chrome, Firefox, and Edge to help it build a new way of telling humans apart from bots online. No more clicking on pictures of traffic lights.
The company announced on June 22 a collaboration with Google, Mozilla, Microsoft, and Shopify to develop Private Access Control Tokens, or PACT. The protocol issues anonymous tokens that let websites verify whether incoming traffic is legitimate without resorting to CAPTCHAs or invasive tracking.
How PACT actually works
PACT takes a fundamentally different approach to bot detection. Instead of challenging users at the point of access, the protocol allows browsers to issue cryptographic tokens that confirm the user’s legitimacy. Websites receiving these tokens can trust that traffic is non-malicious without ever learning who the user actually is.
This isn’t Cloudflare’s first attempt at solving the problem. The company introduced Privacy Pass back in 2017, which laid the groundwork for token-based verification. PACT builds on that foundation but brings something Privacy Pass never had: buy-in from essentially every major browser maker simultaneously.
