Перейти к основному содержимому
Life Security

Поиск по сайту

Поиск страниц и разделов.

Tor overview

Последнее обновление:

Tor lets you use the internet without the sites you visit learning your IP address, and without your internet provider or Wi-Fi operator seeing which sites you visit. It does this by sending your traffic through several relays run by volunteers, each of which knows only a small part of the picture.

It’s worth knowing about if you read sensitive material, live under a network that blocks sites, or want to separate one activity from your usual identity. It’s slower than a normal browser, and it protects less than people assume once you log in to an account or make a mistake.

After reading this you’ll know how Tor works, what it hides and what it doesn’t, when to use bridges, and how to start without undermining it. We don’t cover running a relay, setting up your own onion service, or Tor-based operating systems.

What Tor is, in plain terms

Tor is a network of servers, called relays, run by volunteers and organizations. Software on your device builds a path through several of them and sends your traffic along it. The Tor Project’s specification calls this path a circuit and says it’s typically three relays long.

Here’s a concrete case. You’re in a country where a news site is blocked, or you’re researching a medical condition and would rather your provider didn’t see the pages. With Tor Browser, your provider sees a connection to a Tor relay and nothing else. The news site sees a connection from a relay somewhere else in the world, not from your home.

Most people use Tor through Tor Browser, a modified version of Firefox that routes its traffic through Tor and is built to resist tracking and browser fingerprinting. It keeps no history by default, and cookies last only until you close it or ask for a new identity. It’s available for desktop and Android as of October 2026 (Tor Project).

How it works

  1. Your Tor software downloads a signed list of relays from a small set of directory servers.
  2. It picks a path through relays: a guard (the first), a middle relay, and an exit relay (the last).
  3. It negotiates separate encryption keys with each relay and wraps your data in one layer per relay, like an onion. Each relay peels off its own layer and passes the rest along.
  4. The exit relay connects to the website and returns the reply along the same path.

The result is that each relay knows only the relay before it and the relay after it (Tor specification). The guard knows who you are but not where you’re going. The exit knows where you’re going but not who you are. The middle relay knows neither.

Your Tor client keeps the same guard for a while, about two to three months, and the rest of the circuit changes as you visit new sites (Tor Project). This looks odd but is deliberate. The Tor Project explains that reusing a small set of guards reduces the chance that someone watching both ends can eventually link your traffic to you (Tor Project).

As of October 2026, Tor’s public statistics show about 9,100 relays running and roughly 2,400 bridges, with the number of daily users estimated at around 3.6 to 4 million (Tor Metrics, figures for 9 to 11 October 2026). The user figure is an estimate drawn from directory requests, so treat it as an order of magnitude.

What Tor protects against, and what it doesn’t

Tor helps with these:

  • Websites learning your location. Sites see the exit relay’s address, not yours.
  • Your provider or network operator seeing your activity. People on your local connection, such as your internet provider or whoever runs the Wi-Fi, can’t see what you fetch or from where (Tor Project).
  • A single party knowing everything. Because different people run the relays, no single relay learns both who you are and what you do.

It doesn’t help with these:

  • Your Tor use is visible. Your provider can still see you’re connecting to Tor, and servers can see they’re being contacted by a Tor exit (Tor Project).
  • Accounts you log in to. Logging in or submitting personal details lets a site identify you, and it may learn you’re using Tor (EFF).
  • Anything outside the browser. Only Tor Browser’s traffic goes through Tor. Other apps on your device aren’t routed (EFF).
  • Documents opened outside Tor. EFF warns that opening a downloaded document in another program can reveal your IP address.
  • An observer who sees both ends. If someone can watch your connection into Tor and also the destination or exit, they can match timing patterns. The Tor Project says Tor doesn’t defend against this (Tor Project), and the original 2004 design paper says the same. In September 2024, German broadcaster NDR reported that police had used timing analysis to identify users of Tor services. The Tor Project said it found no sign that Tor Browser was attacked, and tied the case to a long-retired version of a messaging app that lacked protections. It also noted that long-lived connections are more exposed to timing analysis (Tor Project, Risky Biz). The Project couldn’t see the case files, so some uncertainty remains.
  • The exit relay can see unencrypted traffic. The last relay connects to the site on your behalf. If the connection isn’t encrypted with HTTPS, that relay can read it. Tor Browser uses HTTPS-only mode by default (EFF).

How likely is any of this to affect you? Timing attacks need a well-resourced observer, so they matter most if you’re up against a government or large organization. Logging in to your normal accounts is the simplest way to undo Tor’s protection yourself.

Onion services and .onion addresses

Some sites run as onion services, reachable only through Tor at a 56-character address ending in .onion. The traffic between you and the site is end-to-end encrypted, and the site’s own location is hidden too (Tor Project). The Tor Project points to DuckDuckGo’s onion service as a way to test whether your connection can reach them. Because traffic never leaves the Tor network, no exit relay is involved.

Bridges, for when Tor is blocked

Some networks block Tor. Bridges are alternative entry points into the Tor network that aren’t listed publicly, so they’re harder to block (Tor Project). Tor Browser has bridge support built in.

The Tor Project’s guidance for people in censored regions is to try a direct connection first, and use a bridge suited to your country if it fails (Tor Project). As of October 2026, its page lists these types:

Bridge type What it does Where the Tor Project suggests it
Snowflake Uses short-lived volunteer proxies, built into Tor Browser’s bridge menu A fallback in China and Belarus; described as the most reliable option in Turkmenistan
WebTunnel Makes traffic look like an ordinary HTTPS connection to a website The first recommendation in China; suggested in Russia when obfs4 is blocked
obfs4 A widely used bridge type Used in Russia, though some mobile providers now block it with deep packet inspection

Which one works changes over time as censors adapt, so check the Tor Project’s current page for your country before you rely on this table.

Common myths

“Tor is only for criminals.” The Tor Project describes its goal as defending against tracking and surveillance and getting around censorship (Tor Project). Hiding your browsing from a network operator or a tracker doesn’t need a bad reason. Laws on Tor use vary by country, and we haven’t verified them here, so check yours if you’re unsure.

“Tor makes me anonymous.” EFF says it’s generally impossible to achieve perfect anonymity (EFF). Tor removes one big source of identification, your IP address. Your behavior can still identify you.

“A VPN plus Tor is safer.” We couldn’t find independent testing showing this helps. A VPN in front of Tor means one more company can see that you connect to Tor, and it changes who your provider is, not what Tor protects.

What to do

  1. Use Tor Browser for Tor, and nothing else. Download it only from the Tor Project. Other browsers routed through Tor carry serious deanonymization and leakage risks (Tor Project).
  2. Don’t log in to accounts that identify you. If you do, that session is no longer anonymous.
  3. Don’t install extra browser add-ons. EFF warns they could deanonymize you.
  4. Raise the security level when the stakes are high. Tor Browser has Standard, Safer and Safest. Safer turns off JavaScript on sites without HTTPS and makes audio and video click-to-play. Safest turns off JavaScript by default on all sites. Some sites break at higher levels (Tor Project).
  5. Keep Tor Browser updated, and keep long sessions to what you need.
  6. If Tor is blocked, use a bridge. Try Snowflake or WebTunnel first and see the table above.

On a phone

On Android, Tor Browser is available from Google Play and other sources, and it needs Android 5.0 or newer (Tor Project).

On iPhone, there’s no Tor Browser. The Tor Project recommends Onion Browser, but notes that Apple makes every iOS browser use WebKit, so it can’t match Tor Browser’s protections. Security researchers at Mysk reported in August 2026 that WebKit can make direct connections that expose your real IP address even in proxy browsers, including Onion Browser. The report named DNS prefetching, a passkey check and WebTransport. As of August 2026, Apple’s report status said a fix was planned for fall 2026 (Mysk, via iPhone in Canada). We couldn’t confirm whether it has shipped. EFF’s guide advises avoiding Onion Browser on iOS for highly sensitive browsing until Apple fixes it, and we’d follow that. This page is general information, not advice for a specific legal or safety situation.

Sources

Часто задаваемые вопросы