Evaluating ActivityPub Against the AT Protocol: How the Decentralized Web Trades Server Autonomy for Data Portability

Users migrating between decentralized social networks can now carry their entire identity, follower graph, and post history with them across providers without asking an administrator for permission. That capability, enabled by the Authenticated Transfer (AT) Protocol, fundamentally breaks the server-bound identity model that defined the first generation of the federated web. For years, joining a decentralized platform meant accepting a trade-off: escaping corporate control required trusting a volunteer server operator with custody of your digital identity. The emergence of portable Personal Data Servers (PDS) has eliminated that requirement, splitting the decentralized web into two competing architectural philosophies.[1][6]

The divide is not merely technical; it represents a fundamental disagreement over where trust should reside in a network. On one side is ActivityPub, formalized as a World Wide Web Consortium (W3C) standard in 2018 and popularized by Mastodon, which boasts over 4.4 million registered users. On the other is the AT Protocol, developed by Bluesky Public Benefit Corporation (PBC), which treats social data more like a globally accessible file system.[1][2][3]

The conceptual model of ActivityPub closely resembles email. Independent servers send messages to each other on behalf of their users. When a user registers, they receive an identifier tied directly to their host domain, formatted as @user@instance.example. If a user on one server follows someone on another, the protocol simply pushes messages between the respective inboxes and outboxes of those servers.[4]

That simplicity enables broad federation, but it creates a structural vulnerability: the identity is custodial. If an ActivityPub instance administrator shuts down the server, loses funding, or bans a user, that digital identity ceases to exist. While Mastodon offers a migration tool, it requires the original server to remain online long enough to issue a redirect, and it cannot migrate the user's past posts. The user starts over with a blank timeline on a new domain.[1][3]

The AT Protocol was engineered specifically to solve this custodial trap. "Where ActivityPub assumes the instance is the unit of trust, AT Protocol assumes the individual user should own their data regardless of which provider hosts it," notes a 2026 architectural analysis by FediView.[1]

To achieve this, AT Protocol decouples identity from hosting. A user's identity is established through a Decentralized Identifier (DID)—a cryptographic string that exists independently of any server. The actual content, including posts, likes, and follows, is stored in a Personal Data Server (PDS). If a hosting provider fails or becomes hostile, the user simply points their DID to a new PDS and resumes exactly where they left off, with their entire history intact.[1][4]

This cryptographic ownership includes a built-in safety net. The protocol's did:plc directory utilizes priority-ordered rotation keys with a 72-hour recovery window. If a malicious actor compromises an account, the original owner has three days to use their backup key to revoke the attacker's access and restore control—a feature entirely absent from ActivityPub's architecture.[5]

However, that portability comes at the cost of heavy aggregation infrastructure. Because AT Protocol data is scattered across thousands of independent PDS repositories, the network relies on massive "Relays" to ingest the entire global firehose of activity. Applications, known as AppViews, then query these relays to construct user timelines and search results.[4]

Processing that global firehose requires substantial compute. Running a complete AT Protocol relay currently costs approximately $30 to $34 per month in baseline server expenses, a figure that scales linearly with network growth. In contrast, ActivityPub's peer-to-peer model allows small community instances to operate effectively on hardware costing less than $10 a month, as they only process data relevant to their specific users.[2]

The AT Protocol's reliance on global relays also complicates privacy. Because relays aggregate all state changes publicly to ensure network consistency, implementing features like private likes or restricted profiles is architecturally difficult. ActivityPub handles localized privacy effortlessly, as servers only share data with explicitly authorized peers.[1]

Data formatting reveals another philosophical split. ActivityPub relies on JSON-LD, a flexible standard that allows developers to invent new data types on the fly. While this encourages experimentation, it routinely causes compatibility breaks between different fediverse platforms. A poll created on Mastodon might render as a broken link on Pixelfed.[2][3]

Bluesky PBC rejected that flexibility in favor of strict enforcement. "Our solution for portability requires both signed data repositories and DIDs, neither of which are easy to retrofit into ActivityPub," the AT Protocol documentation states. To ensure data remains readable across any application, the protocol uses Lexicon, a strongly-typed schema system that forces all developers to adhere to standardized data structures.[3]

That strict typing is what allows multiple applications to share the same identity. A developer can build a video-sharing app or a code repository that reads directly from a user's existing AT Protocol PDS. The user does not need to create a new account; they simply grant the new application permission to read and write to their existing cryptographic identity.[2]

Despite the technical elegance of AT Protocol, the reality of its deployment remains highly centralized in 2026. While anyone can theoretically run a relay or an AppView, the vast majority of users rely entirely on infrastructure operated by Bluesky PBC. The protocol is open, but the operational gravity still pulls heavily toward a single corporate entity.[1]

ActivityPub faces its own centralization paradox. While the protocol is governed by the W3C rather than a single company, the network exhibits massive instance concentration. Thousands of servers exist, but a handful of massive instances host the overwhelming majority of the network's 4.4 million users, recreating centralized moderation bottlenecks under the guise of federation.[1]

The choice between the two architectures dictates which failure mode a developer or community is willing to accept. ActivityPub offers proven, low-cost infrastructure and genuine community sovereignty, but traps users in custodial identities. AT Protocol delivers cryptographic self-ownership and seamless data portability, but currently demands heavy infrastructure and reliance on centralized aggregators to make the network readable.[1][2][5][6]