The Cypherpunks Mailing List: How Privacy Tech Was Born in a Bay Area Living Room

The first cypherpunks meeting happened in September 1992 at Eric Hughes' rented house in Oakland, California. There were maybe a dozen people. They had been brought together by a shared sense that the cryptography research community had spent the previous fifteen years inventing techniques (public-key cryptography, digital signatures, anonymous credentials, blind signatures) that the actual public was never going to be able to use, because the academic papers stayed in academic journals and the working implementations stayed inside corporate research labs and the government export controls kept anything serious out of the hands of ordinary people.

The argument the three convening hosts (Hughes, Tim May, and John Gilmore) made was that this gap was not a natural condition. It was a political one. The technology to give individuals strong privacy and verifiable identity already existed. What was missing was a community of people willing to build deployable software, share it freely, and treat the writing of cryptographic code as a political act rather than a research curiosity.

Out of that first meeting came a mailing list. Gilmore hosted it on his machine, toad.com. The list ran from late 1992 until roughly 2001, during which time it grew to about seven hundred subscribers and became, in retrospect, the single most consequential gathering of working cryptographers, civil liberties activists, and obsessed independent programmers of the late twentieth century.

The list is closed now. The archives are partially online. Most of the names on the early subscriber rolls are now famous in some context, although the path that led from a 1993 mailing list flame war to the modern privacy tech ecosystem is not always traced cleanly.

Who Started It

Tim May was a former Intel physicist who had retired in his early thirties after stock options vested and had spent the late 1980s and early 1990s thinking about the political implications of widely available cryptography. In 1988 he wrote a short essay called The Crypto Anarchist Manifesto, which he distributed at the Crypto '88 conference and later online. The essay argued that strong cryptography would, by purely technological means, render most government regulation of online activity unenforceable, and that this was a positive outcome.

Eric Hughes was a Berkeley mathematician with a background in cryptography who had been working on anonymous remailer systems. He wrote A Cypherpunk's Manifesto in March 1993 to articulate the project of the new mailing list. The essay's most-quoted line is the one that came to define the whole movement: "Cypherpunks write code." The point being that talking about privacy was not enough. Building working privacy tools that ordinary people could actually use was the only thing that mattered.

John Gilmore was a Sun Microsystems alumnus, EFF cofounder, and the operator of toad.com, the machine that hosted the list. Gilmore had a long history of using lawsuits, public ridicule, and engineering work to push back against government overreach on cryptography and surveillance. He continued to play that role through the entire life of the list and beyond.

The three of them did not see eye to eye on everything. May was a libertarian to anarcho-capitalist who genuinely believed crypto should dissolve government authority. Hughes was more focused on the practical engineering of privacy tools. Gilmore was a working programmer with deep institutional ties through EFF. The fact that the three could agree on a basic project (build, ship, share) without having to agree on the ultimate political destination was part of why the list worked.

The Roster

Calling the cypherpunks list a "who's who" of privacy tech understates how much of the modern stack came directly out of conversations on it. Some of the people who were active subscribers, in alphabetical order and with apologies for omissions:

Adam Back, who proposed Hashcash in 1997 as an anti-spam mechanism using proof-of-work. Hashcash was the direct conceptual ancestor of Bitcoin's mining mechanism. Adam later founded Blockstream and is one of the most prominent figures in modern Bitcoin protocol development.

Bram Cohen, who would go on to write BitTorrent and fundamentally change how large files moved across the internet.

Wei Dai, who proposed b-money in 1998 as a digital cash protocol. B-money was one of the two systems Satoshi Nakamoto cited in the original Bitcoin whitepaper. Wei later wrote Crypto++, a widely used cryptography library.

Hal Finney, the early PGP developer who in January 2009 received the first Bitcoin transaction ever sent. Finney was a beloved figure in the cypherpunks community and has been an important figure in nearly every major cryptographic project from PGP onward.

Julian Assange, who joined the list in his early twenties from Australia and who later founded WikiLeaks. The cypherpunks ethos of cryptographically protected anonymous publication ran straight through into the WikiLeaks operational model.

Phil Zimmermann, the author of PGP and the central figure in the early Crypto Wars. The list was where Zimmermann found his most consistent technical and political support during the federal investigation of him.

Bruce Schneier, whose book Applied Cryptography (1994) was the practical handbook the list members all read and argued about. Schneier was a regular contributor and remains one of the most important security commentators in the world.

Zooko Wilcox-O'Hearn, who would go on to write Tahoe-LAFS, found Zcash, and articulate the Zooko's Triangle theorem about naming systems. Zooko's design sensibility, which emphasized human-usable tools over theoretically pure ones, was shaped by years on the list.

Jacob Appelbaum, who later became a core Tor developer and a complicated public figure in the WikiLeaks orbit.

Many others, including Sameer Parekh, Lucky Green, Robin Hanson, and the pseudonymous Black Unicorn, all of whom were regulars at one point or another and all of whom shaped the technical and political direction of the conversation.

What They Built

The deliverables that came out of cypherpunks-adjacent work, taken as a list, are difficult to read without realizing how much of the modern internet's privacy and security infrastructure traces back to those conversations.

Anonymous remailers, which let people send untraceable email through a chain of forwarding servers, were a direct cypherpunks project. Remailers in turn became the conceptual ancestor of mix networks, which became Tor.

Digital cash protocols were a constant topic. The cypherpunks list workshopped Chaum's e-cash, then Wei Dai's b-money, then Adam Back's Hashcash, then various intermediate designs by other list members, before Satoshi Nakamoto (who almost certainly read the list, although who Satoshi was remains unsettled) synthesized those threads into Bitcoin in 2008.

PGP, although Zimmermann released it before the list formally existed, was sustained as a project through cypherpunks-led testing, evangelism, and political defense.

Strong cryptography in the browser. The fight to get useful encryption into mass-market browsers in the mid-1990s, against State Department export controls, was substantially driven by cypherpunks-affiliated engineers inside Netscape and Microsoft.

The conceptual foundations of decentralized systems, peer-to-peer networking, and cryptographic identity are all directly descended from list discussions in the 1990s.

The total contribution is not measurable in a clean way because so much of it is downstream. But it is fair to say that the privacy and decentralization features of the modern internet would look very different, and probably much weaker, if those nine years of conversation had not happened.

What Closed It

The mailing list itself faded around 2001. There was no single moment of shutdown. Traffic declined. Major figures moved to private mailing lists, IRC channels, and the early generation of crypto-focused web forums. The political environment after September 2001 made some of the more openly anarchist content of the early list awkward to be associated with publicly. Several core figures had moved into companies that had legal exposure they had not had as independent contributors.

The list went dormant. The archives mostly survived. Some of them are searchable today through the Internet Archive and a few academic mirrors. Researchers who study early internet political communities still go back to those archives because the level of technical detail and political seriousness in the discussions is hard to find anywhere else.

What replaced the list was a diaspora. Cypherpunks went on to found companies, run academic labs, work in civil society organizations, contribute to open-source projects, and quietly maintain large parts of the cryptographic infrastructure that the rest of the internet depends on. The community persisted; the central forum moved into many smaller forums.

Coda

The cypherpunks list is sometimes invoked as a romantic memory of a golden age of internet idealism. That framing has some truth to it. The list was idealist. Many of the people on it believed they were working on technologies that would alter the balance of power between individuals and institutions in lasting and positive ways. Some of those technologies (PGP, Tor, Signal) actually did that. Others (Bitcoin) did things that nobody on the list in 1995 would have predicted.

But the more useful frame for thinking about the cypherpunks list is not as a moment in internet history. It is as a model for how a small, focused, technically serious, politically literate community of independent contributors can produce, over a decade, more durable infrastructure than most well-funded institutional efforts.

Cypherpunks wrote code. The code is still running. The list closed. The work continues.