No Login Data Private Local Save

Private State Token Demo - Online Anti‑Fraud Test

8
0
0
0

Private State Token Demo

Test your browser's privacy‑preserving anti‑fraud capabilities

No CAPTCHAs Privacy‑First Anti‑Bot

Browser Support Check

Click the button to detect if your browser supports Private State Tokens (formerly Trust Tokens).

    Token Flow Simulation

    Simulate a real‑world issue & redeem flow. This demonstrates how websites can distinguish humans from bots without tracking you.

    No token issued yet
    *Simulated – no real tokens are created

    Integration Example

    How to request a token from an issuer in JavaScript:

    // Check if API exists if (document.hasPrivateToken) { // Request token from issuer (e.g., your anti‑fraud provider) const response = await fetch('https://issuer.example/.well-known/private-state-token/issuance', { privateToken: { issuer: 'https://issuer.example', type: 'token-request' } }); if (response.ok) { console.log('Token issued successfully'); } }
    For redemption, use type: 'token-redemption' in a fetch request to your site. See Chrome developer docs.

    Frequently Asked Questions

    Private State Tokens (formerly Trust Tokens) are a new web API that allows websites to issue cryptographic tokens to users. These tokens can later be redeemed to prove that the user is a real human—without revealing any personal identity or tracking across sites. They provide a privacy‑preserving alternative to CAPTCHAs.

    Tokens are unlinkable: the issuer cannot tell which token was redeemed on which website, and the redeemer (the site you visit) only learns that you hold a valid token—nothing about who you are. This prevents cross‑site tracking while still proving you are not a bot.

    Currently, Private State Tokens are supported in Google Chrome (version 118 and later) and other Chromium‑based browsers. The API is part of the Privacy Sandbox initiative. Firefox and Safari have not yet implemented it. Use the checker above to see if your browser supports it.

    CAPTCHAs require you to solve puzzles, which disrupts user experience and can be inaccessible. Private State Tokens work silently in the background—no user interaction needed. They also preserve your privacy better than many third‑party CAPTCHA services that can track your behavior.

    No. The cryptographic design ensures that tokens cannot be linked to your identity or used to build a browsing profile. Each token is a blinded signature, and the issuer cannot correlate issuance with redemption. This is a core privacy guarantee of the API.

    In most modern Chrome versions, Private State Tokens are enabled by default. If you are using an older version, you may need to enable the flag chrome://flags/#private-state-tokens. No browser extension is required.

    You need to run an issuer service that complies with the IETF specification. Cloudflare, Google, and other providers offer ready‑to‑use issuer endpoints. Once configured, your site can request tokens from that issuer using the fetch API with privateToken options, as shown in the code example above.
    🔧 Related Tools