A Cypherpunk's Manifesto Explained: Hughes, May, and the Difference

Funding disclosure: CypherpunkGuide discloses donation arrangements and affiliate relationships; qualifying purchases through affiliate links may earn a commission. Paid subscriptions remain a future plan. We reject surveillance advertising, tracking pixels, and sponsored content. Funding does not determine our conclusions.

A phrase can become familiar before its source does. “The cypherpunk manifesto” often arrives attached to an argument about Bitcoin, identity checks, or AI. Before accepting the argument, establish which document it means and whether the modern claim is actually in it.

This reading guide separates the texts, keeps their political differences visible, and provides a downloadable reading map. The map is our editorial analysis, not a survey, experiment, or proof that either author predicted today’s internet.

Revision note, 11 October 2026: This revision replaces the prediction scorecard with attributed readings and limits. It corrects the earlier account of Google-Extended and the suggestion that the movement took its name from Hughes’ essay. It also updates the funding disclosure.

Two Manifestos, Different Questions

#

Hughes’ essay is dated 9 March 1993. May’s is from 1988; his November 1992 repost describes its earlier circulation. They share an interest in cryptography, but should not be treated as one document.

The questions in the last column are our summaries. A manifesto advocates a direction; it does not certify the safety of products later associated with it.

What Hughes Means by Privacy

#

Hughes connects selective disclosure, anonymous transactions, cryptography, published software, and social cooperation. The closing appeal to cooperation matters as much as the engineering.

Hughes distinguishes choosing whom to tell from keeping something from everyone. He illustrates unnecessary identification with a cash purchase of a magazine. His instruction to build privacy systems is captured in the phrase “Cypherpunks write code.” Near the end, he also makes widespread privacy depend on people cooperating.

Our reading: inspect both the mechanism and the people it depends on. Public source code gives readers something to examine. It does not, by itself, establish that a deployed service runs that code or that every component is safe. Treating the essay as a promise that mathematics abolishes trust loses the social part of its argument.

What May Predicts, Including the Harms

#

May anticipates anonymous communication and trade, with reputation playing an important role. He also explicitly anticipates serious abuse. His text is a political forecast, not just a celebration of privacy tools.

In his 22 November 1992 introduction, May dates the essay to mid-1988 and says he read it at the September 1992 founding meeting. The date of that repost is not the date of composition.

The essay includes stolen information and violent criminal markets among the possibilities. Keeping that passage in view prevents an account in which the author foresaw only benefits. Equally, the existence of a harmful application would not establish that every privacy-preserving design has the same consequences.

Our previous scorecard described institutional identity scoring as the inversion of May’s reputation forecast. That was too sweeping: an identity check and a reputation under a pseudonym are different mechanisms. Assessing his forecast would require defined examples, time periods, and counterexamples. This article does not supply that study.

The Background: Chaum and Jude Milhon

#

Privacy engineering preceded these manifestos, and the cypherpunk group preceded Hughes’ essay. Jude Milhon’s contribution to its name belongs in that history.

David Chaum’s 1985 paper, Security Without Identification, describes transaction systems using different digital pseudonyms with different organizations. It explores how payments and credentials could work while limiting the linking of records. These are proposed systems with conditions and participating institutions, not a claim that all identification or trust disappears.

Tim May’s 1994 account, The Cyphernomicon, sections 3.3.3 and 3.3.10, describes the early meetings and credits Milhon with the name. That places the group before the 1993 essay.

Milhon was a programmer and writer, not merely the supplier of a memorable label. The introduction to her 1995 WIRED interview connects her to Community Memory and credits her with the cypherpunk name; her answers discuss women participating in technology. Her contribution deserves space alongside the better-known manifesto authors.

For another account of the work behind the ideas, see Hal Finney before Bitcoin.

Reading the Texts Against the Present

#

A modern comparison is useful when it identifies its source and its limits. It becomes misleading when relevance is presented as proof of a prediction. The table below is a compact view of our reading map, checked on 11 October 2026.

Download the full reading map, with source URLs and editorial comparisons (CSV). Locations refer to passages or section headings, rather than paragraph numbers that vary between reproductions. The Google row checks our contemporary explanation; it is not part of either manifesto.

The Google crawler documentation says Google-Extended has no separate HTTP User-Agent, the identifying text sent with a web request. It is a control token in robots.txt. A request carrying an AI-related name is not, by itself, proof of its operator, training use, or citation. Our crawler-verification guide explains the measurement limits.

Likewise, the questions explored in our AI-age threat model, social-media footprint guide, and age-verification guide need their own evidence. They are contemporary applications, not statements Hughes made about AI or today’s identity systems. Deletion can reduce future exposure without recalling every earlier copy; its limits should not become an excuse to declare deletion useless.

Three Questions a Reader Can Use

#

Our practical extension of this reading is to ask what a system reveals, whom it requires you to trust, and what evidence supports its promises. This is an editorial framework, not a quotation or an anonymity guarantee.

1. What must I reveal? Distinguish what is needed for the task from what the operator chooses to collect.
2. Whom must I trust? Locate the operator, device, recipient, and recovery process. A technical protection and an organizational promise can coexist.
3. What can I check? Ask which claims are backed by code, documentation, independent inspection, or a reproducible test, and which remain assumptions.

Keep the failure case visible. Our government-data-breach guide considers what to do when information already entrusted to an institution escapes. The design question and the response to a failure are related, but neither substitutes for the other.

Frequently Asked Questions

#

Which manifesto should I read first?

#

For this guide’s privacy questions, start with Hughes, then compare May. That is a suggested reading order, not a ranking of historical importance. The comparison above gives each text’s author, date, and focus.

Who wrote the manifesto, and who named the movement?

#

Hughes wrote A Cypherpunk’s Manifesto; May wrote The Crypto Anarchist Manifesto. May’s historical account credits Jude Milhon with the group’s name. Naming the movement and writing a manifesto are separate contributions.

Do I have to be a programmer to use these ideas?

#

No. The three questions above are useful without programming. A reader can ask for evidence and identify remaining trust assumptions without claiming to have audited the software.

Does this article show that the predictions came true?

#

No. It provides an attributed reading, not an empirical test of historical forecasts. A study of those forecasts would need explicit criteria and contrary evidence as well as supporting examples.

Sources

#

These links identify the texts used for this reading.