Killing CAPTCHAs With One iOS 16 Setting
Nobody enjoys proving their humanity by picking out crosswalks from a grid of photos. Apple’s iOS 16, released to the general public on September 12, includes a setting that can quietly retire that ritual on supported sites. The feature, called Private Access Tokens (PATs), performs automatic verification in the background, and it only needs to be switched on once.
The toggle lives at Settings > Apple ID > Password & Security > Automatic Verification. On most updated devices it is already enabled; if not, flipping it takes effect immediately. iPadOS 16 and macOS 13, expected in October, will carry the same capability.
How the Verification Flow Changes
Private Access Tokens replace the visible CAPTCHA challenge with an invisible handshake. When you visit a site that uses Cloudflare’s Managed Challenge, the server asks your device vendor to confirm the request came from a genuine device and a real human. The vendor responds with a cryptographic token, and no CAPTCHA is ever presented.
For end users, the practical difference is simple: supported iOS and Mac devices no longer see CAPTCHAs when accessing the Cloudflare network. The validation is private, so no personal data is exchanged, and no fingerprinting is required to establish trust.
The mechanics matter for anyone building or operating a web service:
- Developers get proof that a visitor is a human on an authentic device, verified directly by the device vendor, without maintaining a custom SDK for verification.
- Cloudflare customers do nothing. Any account using Managed Challenge — rather than the legacy CAPTCHA option — automatically requests and consumes PATs.
- Internet users see a faster, cleaner mobile browsing experience on devices and browsers that support the protocol.
Standards Work and What Comes Next
The feature extends the IETF’s Privacy Pass protocol with a new cryptographic token type. The work is a collaboration between Cloudflare, Apple, Google, and other industry players, and the token design covers browsers, browser-issued API calls, and in-app API requests alike.
Cloudflare already folded PAT support into its Managed Challenge platform, meaning the majority of its customers are positioned to use the technology without changing any firewall rules. According to the company, more than 65 percent of customers already choose Managed Challenge over the legacy CAPTCHA response, so the transition is largely invisible on the server side.
Why CAPTCHAs Fail on Mobile
The push to eliminate CAPTCHAs stems from their poor fit in mobile environments. When a site cannot issue a visual challenge, it often resorts to collecting private data to assess whether a visitor is a bot. PATs break that trade-off by asking the device vendor — who already holds the relevant attestation data — to perform the check on the site’s behalf. The site confirms the result without ever touching the underlying raw data.
Apple’s inclusion of PATs in its current operating system cycle gives the standard a significant install base, and more vendors are expected to announce support in the near future. For individual iPhone users on iOS 16, the only required action is confirming that Automatic Verification is enabled.
