Today we are announcing a new privacy feature coming to Kagi Search. Privacy Pass is an authentication protocol first introduced by Davidson et al., in [1], and recently standardized by the IETF as RFCs [2—4]. At the same time, we are announcing the immediate availability of Kagi’s Tor onion service.

In general terms, Privacy Pass allows “Clients” (generally users) to authenticate to “Servers” (like Kagi) in such a way that while the Server can verify that the connecting Client has the right to access its services, it cannot determine which of its rightful Clients is actually connecting. This is particularly useful in the context of a privacy-respecting paid search engine, where the Server wants to ensure that the Client can access the services, and the Client seeks strong guarantees that, for example, the searches are not associated with them.

As a privacy-respecting search engine, Kagi’s business model is such that we have no incentive to track what an individual user is searching for. We are in the business of selling a search product, not selling user data or attention.

Now, Privacy Pass adds another layer of trust: we can verify that you have the right to search without knowing who you are or what you’re searching for. It’s one thing to promise we won’t track you; it’s another to make it technically impossible. We jumped on the opportunity to implement Privacy Pass as soon as the IETF made it an official standard.

This matters, because for many users, privacy isn’t just about incentives and privacy policies; it’s about proof. When we cannot track you even if we wanted to, that’s genuine privacy.

Initially, we will be offering Privacy Pass to all our plans with unlimited searches: Professional, Ultimate, Family, and Team plans. Privacy Pass will not be available to Trial and Starter plans due to technical limitations at this moment (see below for more info).

To get started with Kagi Privacy Pass right away:

• Download the newest version of Kagi’s Orion Browser (for macOS/iOS/iPadOS) with Kagi Privacy Pass natively integrated. You will need at least 0.99.131 for macOS and 1.3.17 for iOS/iPadOS (they are expected to be rolling out globally today).

OR

• Download the newest version of Kagi for Android app with Kagi Privacy Pass natively integrated. You will need to use at least version 0.29 (this is expected to roll out globally today).

OR

• Download the extension for Firefox or Chrome
• If you are already using the Kagi Search extension, you will want to update it to the latest version (0.7.6 on Firefox, 1.2.2.5 on Chrome) to avoid compatibility issues, or simply disable it.
• Safari is not yet supported due to technical limitations, see the F.A.Q. below.

In addition our implementation of Privacy Pass is open sourced and you can find it here.

When using Kagi Privacy Pass mode, you’ll be truly anonymous – which means your account settings won’t be available since we can’t identify which user you are.

But don’t worry – we’ve made it flexible. You can easily toggle Privacy Pass on or off based on your needs. Think of it as two modes: full features with normal privacy, or maximum privacy with core features. You choose what makes sense for you based on your context and needs.

Privacy Pass uses cryptography to allow a client to authenticate to a server by performing a protocol with two phases: token generation and token redemption.

Token generation

In the initial “token generation” phase, the client interacts with the server to generate some authentication “tokens.”

For the server to willingly participate in this protocol, the client must prove their “right” to generate tokens.

In the case of Kagi’s users, this can be done by presenting their Kagi session cookie to the server.

The tokens eventually generated by the client at the end of this phase are indistinguishable from a randomly generated token from the server’s point of view. They cannot be traced back to the user who generated them, or to other tokens generated by the same user at the same or a different time.

Token redemption

After token generation is performed, a client can initiate a “token redemption” phase.

During this phase, the client actually accesses the services provided by the server, proving the client’s right to access the services by presenting one of the previously generated tokens.

Since the previously generated tokens are unknown and unpredictable to the server, the latter can only tell that the client has successfully completed token generation at some point.

Technically, we say that the techniques used by Privacy Pass result in the two phases being “unlinkable”. While the server is able to tell whether a token presented for redemption was previously generated by interacting with a rightful client, it cannot link the token to a specific token generation phase.

Crucially, tokens are single-use: servers keep track of which tokens have already been redeemed to avoid multiple redemptions. Furthermore, clients should not present the same token twice to prevent different redemption phases from being linked.

Tokens have a fixed life span. If they are too old, they will stop being redeemable. In that case, a new token generation phase must be initiated by the client to obtain new tokens.

Deployment model

As standardized in [2 – 4], the Privacy Pass protocol is able to accommodate many “architectures.” Our deployment model follows the original architecture presented by Davidson et al. [1], called “Shared Origin, Attester, Issuer” in § 4 of [2].

Here, Kagi plays all the “Server roles” (Attester, Issuer, Origin), and Kagi users play the Client role via the new Kagi browser extensions for Privacy Pass, or via native support in Orion. This is what it looks like in practice:

1. Once installed, and periodically, the browser extension will generate and store a large number of tokens.
2. The user can mark in the extension whether searches should be performed by authenticating classically via a session cookie, or by using Privacy Pass.
3. If the user chooses the second option, they will authenticate to Kagi during the search by redeeming one of the tokens it previously generated.

Usage

Using Privacy Pass is as easy as clicking a toggle.

Orion browser

If you are using the latest version of Orion for macOS, select Kagi as your search engine in Settings -> Search and then enable the checkbox for showing Privacy Pass options on your toolbar.

From there you can easily toggle when you want to use Privacy Pass or standard authentication.

On iOS and iPadOS, Kagi Privacy Pass is natively supported in the latest version of the Orion Browser for iOS and iPadOS and takes just a few clicks to enable.

Note: The Orion iOS app is under review by Apple and will soon be available for download.

Kagi app for Android

Our Android app now supports Privacy Pass mode via an app shortcut. Launching the shortcut allows you to browse Kagi seamlessly in Privacy Pass mode. You can also add the shortcut to your home screen for quick access.

This feature lets you either use Kagi exclusively in Privacy Pass mode or switch effortlessly between modes.

Note: The Android app is currently under review by Google Play and will be available for download soon.

Chrome and Firefox browser extensions

If you are using the Kagi Privacy Pass extension for Chrome or Firefox, once installed you should see the Kagi Privacy Pass icon on your toolbar.

Once installed, the extension automatically generates tokens. To use them, click the extension icon, and make sure the toggle is on.

Note that Safari is not supported at this moment; see the F.A.Q. below for more information.

As used by Kagi, Privacy Pas