v150 · origin trial · identity · auth · forms

Email Verification Protocol

Chrome 150 begins an origin trial for the Email Verification Protocol (EVP), a browser-mediated mechanism that lets websites obtain a cryptographically verified email address without sending an OTP email. The browser handles the verification flow using the user's existing mail provider authentication, removing the step where users must copy a code from their inbox.

Origin trial Email Verification Protocol is in origin trial from Chrome 150 through Chrome 153. An origin trial token is required to use it in production. Register at developer.chrome.com/origintrials.

at a glance

Origin trial start	Chrome 150 (desktop)
Origin trial end	Chrome 153
Platform	Desktop first; Android planned later
Standards body	WICG — Email Verification Protocol
ChromeStatus	5205725253074944 — Email Verification Protocol

Source: chromestatus.com/feature/5205725253074944

why it exists

Verifying ownership of an email address is a friction-heavy step in account creation and recovery flows. The standard approach — sending a one-time code to the address and asking the user to copy it back — requires the user to switch apps, find the email among promotional noise, and manually transcribe the code. The process is also vulnerable to phishing and SIM-swapping when email is used as a second factor.

The Email Verification Protocol delegates verification to an issuer — typically the mail provider (e.g. Google for @gmail.com addresses). The browser calls the issuer using the user's authentication session already present in the browser, the issuer returns a signed token proving ownership of the address, and the browser forwards that token to the relying party. The user never sees an email with a code.

A key privacy benefit is that the issuer does not learn which website is requesting the verification because the request is mediated by the browser without exposing the relying party's identity to the issuer.

Source: WICG EVP explainer

how it works

Step	Description
1. User types email	User fills in an email address in an `<input type="email">` form field
2. Site requests verification	Site calls the EVP JavaScript API passing the email address
3. Browser DNS lookup	Browser resolves `_email-verification.<domain>` TXT record to find the issuer for that mail domain
4. Issuer challenge	Browser calls the issuer endpoint with the user's existing authentication cookies; issuer returns a signed verification token
5. Token delivery	Browser passes the token to the website; website verifies the token against the issuer's public key
Result	Website obtains cryptographic proof that the user controls the email address — no OTP email sent

Source: WICG EVP explainer

example (origin trial)

// Requires origin trial token for Email Verification Protocol
// Flag: #email-verification-protocol

if ('EmailVerification' in navigator) {
  try {
    const token = await navigator.emailVerification.verify(
      'user@example.com'
    );
    // Send token to server for verification
    const res = await fetch('/verify-email', {
      method: 'POST',
      body: JSON.stringify({ token }),
      headers: { 'Content-Type': 'application/json' },
    });
    if (res.ok) {
      console.log('Email verified without OTP!');
    }
  } catch (err) {
    // Issuer not found for domain, or user declined
    console.log('Falling back to OTP flow');
  }
}

Source: WICG EVP HOWTO

browser support