Exit Node
For ordinary internet destinations, the exit node is the last Tor relay. It sees the destination address and unencrypted traffic, but does not directly know the user's IP. HTTPS therefore remains essential. Onion services have no exit node.
The point where Tor ends
At the exit, traffic leaves the Tor network and continues as an ordinary internet connection. The last Tor encryption layer is removed here. What remains is exactly the protection the application itself provides: with HTTPS the content stays encrypted between browser and destination server; with unencrypted protocols it sits in the clear in front of the exit operator.
The right expectation
An exit is not malicious by default, but it is not trustworthy in principle — just like any public Wi-Fi. Tor’s security model accounts for that. The destination sees the exit’s IP instead of yours; linking that back to the access connection only works if someone also observes the Guard Node. Anyone who does not send confidential data over unencrypted sites takes away the exit’s most effective attack.
Connections without an exit
With an Onion Service v3 there is no exit at all. Client and service meet at a rendezvous point inside the network, so traffic never leaves Tor. The question of a trustworthy last relay does not arise.
For operators, the exit role is the most demanding: abuse complaints land at the relay’s IP. Serious operators therefore publish exit policies and keep reachable abuse contacts. The full path through the circuit is described in What is Tor?.
Category: Network