Why iCloud Private Relay Uses a Two-Hop Architecture
This article explains the reasoning behind iCloud Private Relay's two-hop architecture in the Safari web browser. By splitting internet traffic routing between Apple and trusted third-party content delivery networks (CDNs), the system ensures that no single entity—not even Apple—can simultaneously know both a user's identity and the websites they visit. This overview covers how the two relays function, the privacy flaws of traditional single-hop connections, and why this dual-provider approach is essential for complete user anonymity and fast browsing speeds.
The Problem with Single-Hop Privacy
To understand why Apple uses two hops, it is necessary to look at how standard internet connections and traditional Virtual Private Networks (VPNs) work. Normally, your Internet Service Provider (ISP) sees both your IP address (who you are) and the DNS requests for the websites you visit (where you are going).
When you use a traditional VPN, it acts as a "single-hop" relay. While this hides your browsing activity from your ISP, it simply shifts all that data to the VPN provider. The VPN company still has access to both your real IP address and your browsing destination. Users must blindly trust that the VPN provider is not logging or selling this information.
Hop One: The Ingress Proxy (Managed by Apple)
iCloud Private Relay solves the single-hop trust issue by dividing the routing process into two separate steps, managed by two different companies.
When you browse the web using Safari, your traffic first goes to an ingress proxy server operated by Apple.
- What Apple knows: Apple sees your real IP address, which is linked to your device and iCloud account.
- What Apple does not know: The actual website address you are trying to visit is encrypted before it leaves your device. Apple cannot read this encrypted data.
Apple’s server strips away your real IP address and forwards the encrypted website request to the second hop.
Hop Two: The Egress Proxy (Managed by Third-Party CDNs)
The second hop is an egress proxy operated by a trusted third-party content delivery network, such as Cloudflare, Akamai, or Fastly.
- What the CDN knows: The CDN receives the encrypted request from Apple, decrypts the destination website's address, generates a temporary, anonymous IP address for you, and connects you to the website.
- What the CDN does not know: Because Apple stripped away your original IP address in the first hop, the CDN has no way of knowing who made the request. It only sees that a request came from an Apple server.
Privacy by Architecture, Not Policy
By dividing the traffic between Apple and a third-party CDN, iCloud Private Relay enforces privacy through technical architecture rather than corporate promises.
- Your ISP only sees that you are connected to an Apple server, not what websites you are visiting.
- Apple knows who you are, but cannot see what websites you are visiting.
- The Third-Party CDN knows what website is being visited, but does not know who is visiting it.
- The Destination Website only sees the temporary IP address provided by the CDN, preventing it from tracking your real location or identity.
For your browsing history to be compromised, both Apple and the third-party CDN would have to collude and combine their separate halves of the data, which is prevented by strict contractual and technical barriers.
Why Use Content Delivery Networks?
A common downside to routing internet traffic through multiple servers is a reduction in browsing speed. Apple specifically partnered with major third-party CDNs for the second hop to prevent lag in Safari.
CDNs own massive, globally distributed networks of servers that already host a large portion of the world's web content. By using CDNs for the second hop, your traffic exits the relay physically close to the servers hosting the websites you want to visit. This ensures that the two-hop privacy mechanism remains fast and seamless for the everyday Safari user.