Privacy Proxy Demo

Cloudflare's Privacy Proxy is a MASQUE-based forward proxy designed to hide a client's IP while retaining coarse location context. Send the same request directly and through the proxy, then compare what this destination observes.

More info

Demo capabilities: This demo uses pvcli (our demo client), which tunnels HTTPS via HTTP CONNECT over HTTP/2. It represents a single-hop deployment (client → Cloudflare Privacy Proxy → destination). MASQUE protocols are also supported by production deployments, but are not demonstrated here. See the developer docs for the full protocol and deployment details.

Who is the client? For this demo, your machine acts as the client. In production, the client represents an end user or application accessing a destination.

Full product documentation: Privacy Proxy developer docs.

Try the demo in CLI mode instead

Prefer a guided terminal walkthrough? Download the standalone script, then run it with pvcli. You will also need curl and jq.

Install pvcli.

cargo install --git https://github.com/cloudflareresearch/pvcli --locked

Download the terminal demo.
Download privacy-proxy-demo.sh ↓
Open your Downloads folder and allow the script to run.
```
cd ~/Downloads
chmod +x privacy-proxy-demo.sh
```
Start the walkthrough.
```
./privacy-proxy-demo.sh
```

pvcli mints a fresh Privacy Pass token for the proxy request. The script does not print the token or signed session value.

connecting…

Before you start

Set up the pvcli demo client

pvcli is the open-source command-line client used to send both requests in this demo. View the source on GitHub, and install it with Cargo below.

Before running this: Make sure Rust and Cargo, Git, CMake, and Apple's command line tools are installed.

Install pvcli

Cargo downloads the public source, builds it, and installs the pvcli command.
```
cargo install --git https://github.com/cloudflareresearch/pvcli --locked
```
Check the installation

A list of pvcli options means the client is ready for the demo.
```
pvcli --help
```

Before running this: Make sure Rust and Cargo, Git, CMake, Clang and libclang, pkg-config, and standard C/C++ build tools are installed.

Install pvcli

Cargo downloads the public source from GitHub, compiles it, and installs the command.
```
cargo install --git https://github.com/cloudflareresearch/pvcli --locked
```
Check the installation

A list of pvcli options means the client is ready for the demo.
```
pvcli --help
```

First source build: pvcli compiles its networking and security dependencies on your machine, so installation may take several minutes.

Already have pvcli? You can skip these steps.

Direct Request A normal request, no proxy. The destination sees the client's IP and estimates its location.

What's this?

In this demo, your machine acts as the client and sends an ordinary request directly to the demo destination, a Cloudflare Worker. The destination records what it sees.

Client

your machine. It normally sends requests like this automatically in the background.

Your IP-based location: New York City

Copy this and run it in your terminal. You're manually sending a request that client software would normally send automatically.

direct connection

No proxy

nothing in between

arrives as-is

DESTINATION SEES

Run the command — this fills in live.

Privacy Proxy Request Choose the approximate area Privacy Proxy uses to guide geographic egress.

What's this?

The same request as before, now pointed at Privacy Proxy. The selected geohash describes a broad area used to guide egress selection. The destination independently estimates location from the egress IP, so results depend on its IP-geolocation database.

Client

still your machine, but this time routing its request through Privacy Proxy.

Your IP-based location: New York City

Obfuscation level

Copy this and run it in your terminal. pvcli will mint a fresh Privacy Pass token and use it to authenticate to the proxy.

What changed: the same pvcli command, plus -x to route through the proxy, --pat-issuer for Privacy Pass authentication, and a geohash header on CONNECT.

To see the Privacy Pass issuance flow step by step, try the demo from the Privacy Pass developer documentation.

🔒 encrypted tunnel

Cloudflare Privacy Proxy

replaces the client's IP · carries geolocation context

egress → destination

DESTINATION SEES

Run the command — this fills in live.

Side-by-side comparison

BEFORE — DIRECTyour client IP and estimated location

Run the Direct Request.

AFTER — PRIVACY PROXYCloudflare egress IP and estimated location

Run the Privacy Proxy Request.

Choose a precision to see the area Privacy Proxy uses for egress selection. The destination does not receive this geohash.

Direct requestOriginal IP database result

Run the direct request to fill this in.

Privacy Proxy requestProxy IP database result + proxy input

Run the Privacy Proxy request to fill this in.

What's on the maps

Direct IP estimate — the red circle illustrates the geolocation accuracy a destination perceives based on the original IP (accuracy is set to about a city).
Proxy IP estimate — the green circle shows the same illustrative city-scale accuracy that the destination perceives, but based on the proxy IP.
Requested geohash area — the orange rectangle is the client's real location obscured to the area selected by the geohash. It is sent to Privacy Proxy and used to select the egress IP shown to the destination, but the destination never sees it.

Note: IP-based geolocation is usually accurate to about a city, which is what is illustrated here. However, accuracy can vary depending on the database a destination uses for IP resolution.

Why it matters