That's apparently explained in their citation [1], the paper about cryptographically anonymous token protocols. It's not a simple plaintext token. https://pets

That's apparently explained in their citation [1], the paper about cryptographically anonymous token protocols. It's not a simple plaintext token. https://petsymposium.org/popets/2018/popets-2018-0026.php https://petsymposium.org/popets/2018/popets-2018-0026.php ("Privacy Pass: Bypassing Internet Challenges Anonymously") I think Cloudflare implemented the same thing? At least the HN comments link to the same paper, https://news.ycombinator.com/item?id=19623110 https://news.ycombinator.com/item?id=19623110 ("Privacy Pass (cloudflare.com)", 53 comments)