| created on | August 28, 2026 |
HPKP (HTTP Public Key Pinning) is an obsolete security mechanism defined in RFC 7469.
HPKP worked with the TOFU principle (Trust on First Use). The first time a browser visited a site, it received a Public-Key-Pins HTTP header containing SHA-256 hashes of SPKI (Subject Public Key Info). On later visits, the browser computed the SPKI fingerprints of the presented certificate chain. At least one of the presented public key hashes had to match the stored pin set. If it failed, the browser treated the error as non-recoverable and blocked the connection. Implementations required at least one active pin and one backup pin (not currently in use) to prevent lockouts during certificate renewals.
The operational overhead and strict requirements led to very low real-world usage. Misconfigurations, lost backup keys, or compromised intermediate/root authorities could permanently lock out users for the duration of the max-age period, a.k.a. “HPKP Suicide”.
Major browsers (i.e., Google Chrome in 2018/2019 and Mozilla Firefox in 2020) completely removed support for HPKP.