Email Verification Protocol (EVP)

Chrome first-party documentation, published 8 July 2026, for an origin trial of a protocol that lets a site confirm you own an email address without sending you anything. T1 — vendor docs for the vendor’s own feature, which is authoritative about the mechanism and not about whether it is a good idea.

The friction it targets: verification today means leaving the signup flow to fetch a code or click a link, and every hop loses users. EVP verifies silently against a session you already have.

The mechanism

Three roles. The verifier (relying party) is the site collecting the address. The email provider hosts it. The issuer — accounts.google.com for Gmail — is the account service holding your session.

1. You pick an address from autocomplete. The browser looks up a DNS _email-verification record to find the issuer for that domain.
2. The browser generates an ephemeral key pair and asks the issuer for a token via a request_token JWT.
3. The issuer checks your first-party session cookies and returns a Selective Disclosure JWT confirming the address.
4. The browser wraps that in a key-bound JWT using the ephemeral key, a nonce, and the site’s origin.
5. Form submission hands the site an Email Verification Token.

The verifier then parses the SD-JWT+KB (the ~ separator), checks email, nonce, audience and timestamp, confirms the key binding by sha256 comparison, resolves the issuer delegation in DNS, and checks the signature against the issuer’s JWK Set at /.well-known/email-verification. EdDSA and ES256, over JOSE.

What is privacy-preserving here, and what that reveals

The claimed properties are specific and structural rather than promissory. The issuer never learns which site asked — Google doesn’t see that you signed up for a competitor’s product. The verifier learns nothing during the browser↔issuer exchange; it receives the address only when the form is submitted. First use of an address requires an explicit permission prompt.

Worth noticing where that lands in this spoke’s map. The privacy current here has been the challengers’ pitch — brave blocking trackers, vivaldi refusing generative AI, ladybird taking no money. EVP is the incumbent shipping a protocol whose privacy guarantees come from cryptography rather than policy, and whose main beneficiary is the user’s relationship with Google. Privacy as an architectural property is not the exclusive property of the browsers that market it.

The concentration problem the docs don’t name

The protocol is open on paper: a WICG browser-API spec, an IETF draft (draft-hardt-email-verification-00), DNS-based issuer delegation so any provider can participate.

The working deployment is Google end to end. Chrome is the browser holding the ephemeral key. Gmail is the participating provider — “@gmail.com addresses work without additional configuration.” accounts.google.com is the issuer. One company occupies all three roles at launch, and the value of the protocol to a site is exactly the fraction of its users whose provider participates. That is a strong first-mover position in a mechanism that could become how the web establishes email ownership, and the docs present it as a convenience.

Not a criticism of the design, which is delegation-based specifically so others can join. Recorded because “open standard, one implementer” is a shape worth tracking, and the spoke already watches Chrome’s platform gravity through chrome-built-in-ai.

Limitations, stated by Chrome

• No feature detection. Sites must treat the token as an optional extra and keep the old path.
• Requires a live session with the email provider.
• Autocomplete only — typed addresses are “planned for a future release.”
• It verifies ownership, not deliverability. EVP does not confirm mail actually reaches the user, so welcome and onboarding emails may still be needed. It removes the code, not the message.
• Issuer API still under development; backwards-incompatible changes expected; the request format is moving from form-encoding to JSON and request_token to HTTP Message Signatures.

Chromium component Blink > Identity > EVP. Demos at rowan.fyi.

Related

browser-as-trust-intermediary · chrome-built-in-ai · gemini-in-chrome · brave · vivaldi · synthesis