Cloudflare Details MOLE, a Post-Quantum Way to Prove You Are Real Without Being Tracked

Cloudflare published research on 6 November 2026 describing MOLE, short for Moderation Of unLinkable Endorsements. It is a family of post-quantum anonymous credentials being developed with others, including Mozilla. The goal is to let a person prove something, such as being a real user, without a website being able to link their visits together.

The problem it addresses is quantum computing. Privacy Pass, the system many sites use to reduce CAPTCHAs, still relies on classical cryptography. A quantum attacker could forge its tokens, although the privacy guarantee for users would still hold.

Two schemes are in development. VOLE-IHAT is a candidate for MOLE endorsements and VOLE-ACT is a candidate for MOLE credentials. Both build on VOLE-in-the-Head zero-knowledge proofs and the UOV signature scheme. Cloudflare reports that each operation takes a few milliseconds in its implementation.

The sizes are the practical constraint. Cloudflare's estimates, which may change, put VOLE-IHAT at 5.6KB to issue and 6.5KB to redeem. VOLE-ACT is 5.4KB to issue and 12.0KB to spend. UOV public keys are 46.6KB. These are much larger than classical equivalents, which is why the authors cut down the Keccak permutation to shrink the proofs.

This is research, not a deployed product, and there is no release timeline. The authors still need security proofs and expect further cryptanalysis of UOV before the parameters settle. An implementation is on GitHub at cloudflareresearch/vole-mole for people who want to read the details.

For web designers and developers, nothing changes today. The reason to follow it is that bot checks and agent verification are likely to move to this kind of credential, and the user experience of those checks will shape how forms and sign-ups feel. Privacy-preserving verification that adds no visible friction is better than a puzzle in every login.

It also fits a wider pattern from the same week, where Cloudflare is working on how to tell good automated traffic from bad without tracking every visitor.