Expanding Human Verification Beyond the CAPTCHA
Cloudflare is widening the reach of its Cryptographic Attestation of Personhood (CAP) experiment, adding support for a substantially broader set of hardware authenticators. The update brings biometric authentication—including Apple's Face ID, Microsoft Hello, and Android Biometric Authentication—into the fold, letting users complete verification in under five seconds with a fingerprint or facial scan.
These biometric checks are processed entirely on-device. Cloudflare never receives or processes the underlying biometric data; the device confirms a match and sends only a standard attestation message, the same kind a hardware security key would generate. Users can test the expanded flow at cloudflarechallenge.com.
Beyond biometrics, the experiment now supports all USB and NFC security keys that are both FIDO-certified and free of known security issues according to the FIDO Alliance Metadata Service (MDS 3.0).
How the Privacy Model Works
The privacy architecture relies on Trusted Execution Environments (TEEs) and Trusted Platform Modules (TPMs) built into modern devices. Each major operating system vendor—Apple's Secure Enclave, Microsoft's Windows Hello framework, and Google's Android Biometric Authentication—uses such isolated hardware to store and validate biometric information. Applications running on the device, including browsers, never access the raw data and cannot transmit it externally.
The WebAuthn standard reinforces these boundaries. When a user authenticates with a biometric key, no third party—including Cloudflare—can intercept the biometric data. It never leaves the device and is never sent by the browser. Cloudflare only observes an attestation identifier shared by thousands of identical devices, which reveals at most the hardware's make and model without enabling unique tracking.
Pushing Privacy Further With Zero-Knowledge Proofs
The team has also been working to shrink the information disclosed during attestation. While the current design already limits exposure to non-unique device metadata, Cloudflare is exploring zero-knowledge proofs (ZKP) to reduce the disclosed information to a single fact: that the user possesses a valid security key capable of generating an approved certificate. With ZKP, Cloudflare would learn nothing else about the device or its provenance.
Performance and Usability Findings
Cloudflare set out with three goals for CAP: improving the humanity-verification experience, ensuring accessibility for global users including those on mobile, and preserving the effectiveness of its existing bot management systems. Early proof-of-concept testing with Face ID showed solve times significantly faster than image-selection CAPTCHAs, with near-zero error rates. Test subjects expressed strong preference for the biometric flow and offered UX suggestions that were folded into the deployment.
Production telemetry from the first CAP phase reinforced these results. Although biometric attestation was not yet enabled, Cloudflare recorded when users attempted to use such services. Face ID on iOS and Android Biometric Authentication showed the highest attempted solve rates among mobile options, after YubiKeys. That data informed the decision to bring biometric providers into the active challenge flow.
User privacy concerns surfaced during testing, and Cloudflare emphasizes that the protections for biometric readers match those for hardware keys: the fingerprint or facial scan never leaves the device, and the attestation message merely confirms that a valid biometric match occurred on trusted hardware. Feedback continues to be collected via a survey linked from the demo site.
