Short answer: Tor (The Onion Router) is an open overlay network. It wraps connections in several encryption layers and routes them through typically three relays — guard, middle, and exit. The ISP sees the entry, the website sees an exit IP, and no single relay should know both. Tor is generally legal in the EU and most of Western Europe, but it does not make you invisible.
Tor is a freely available network and a bundle of open-source programs that make it harder to link an internet connection to the destinations it visits. The name comes from “The Onion Router.” The onion image describes the central idea: a connection is wrapped in several encryption layers and sent through several independent stations. No single station should know both who started the connection and where it ultimately goes. The technical deep dive is under Onion Routing; practice is under Tor Browser setup.
That matters because ordinary internet traffic leaves many metadata traces. An ISP normally sees which servers a connection reaches. A web server sees visitors’ public IP addresses. Anyone who combines enough of those facts can infer interests, habits, and relationships even when the content itself is encrypted with HTTPS. Tor separates those two perspectives. It is a tool for improving privacy, not a magic invisibility feature.
What Tor actually protects
In a normal website visit, the device connects through the ISP almost directly to the destination server. HTTPS encrypts the content, but the destination IP stays visible to the provider and the source IP stays visible to the website. With Tor, the ISP instead sees a connection to a Tor entry node. The website sees a connection from a Tor exit, not the original IP address. Relays in between carry the data without knowing the full picture.
This protection is mainly about network metadata. Tor can keep a website from learning the connection IP outright and makes it harder for local observers to see the destination. It does not stop someone from identifying themselves voluntarily. Logging into a personal account in Tor Browser still gives the service the account information. Texts, uploaded documents, payment data, or recognizable usage times can also reveal identity.
Tor is therefore strongest when the tool belongs to a matching threat model and careful behavior. A threat model answers three questions: Which information should be protected? From whom? What resources and capabilities does that adversary have? Measures that help against ordinary tracking differ from those needed for high-risk investigative research.
Onion routing in simple form
Before Tor Browser sends data, it usually chooses a path of three relays. It negotiates its own cryptographic keys with each relay. It then nests the data to be sent in several layers. The first node removes the outermost layer and learns only which second node to forward to. The second removes its layer and knows only predecessor and successor. The third removes the last Tor layer and, for ordinary websites, opens the connection to the destination.
Relays are not chosen purely at random and not anew for every page object. The Tor client considers bandwidth, roles, network families, and further security rules. Several connections can share the same circuit for a limited time. That reduces delay and keeps unnecessarily many relays from getting a chance to observe the user.
Onion routing is not the same as end-to-end encryption. The Tor layers exist between the client and the relays. When traffic leaves an exit toward an ordinary website, HTTPS protects the content on that last hop. Without HTTPS, the exit can read or alter unencrypted content. Tor Browser therefore warns about insecure connections; users should take those warnings seriously and never send confidential data over unencrypted pages.
The three hops of a circuit
Guard node: the stable entry
The first hop is called the guard or entry guard. It sees the user’s IP address, but not the final destination of a correctly built, encrypted connection. Tor chooses only a few guards and keeps them for a long time. That can seem surprising: frequent switching looks safer. In fact, constant switching would raise the chance of eventually hitting a malicious entry node. A small, longer-used set limits that opportunity.
An ISP can see that a connection goes to a known guard. In regions where Tor is blocked or merely using it is sensitive, bridges can help. Bridges are not listed in the normal public relay directory. Pluggable transports such as obfs4 or Snowflake also change the visible pattern of the connection. They are for censorship circumvention; they do not turn a compromised device into a safe one.
Middle relay: the separation in the center
The middle hop does not know the user’s identity. It receives data from the guard and sends it to the exit. Its role is to separate entry and exit spatially and organizationally. An observer who controls only this relay sees two Tor connections but cannot directly determine the original source and the internet destination.
Middle relays carry a large share of the network load. Volunteer organizations and individuals can run them. Operators do not see plaintext of the final web traffic and do not appear to destination servers as an exit. The diversity of independent operators is an important part of the security model: Tor does not promise to trust every relay; it tries to distribute the required trust.
Exit node: the way out to the open web
The exit opens the connection to an ordinary website. The website therefore sees the exit’s IP address. The exit knows the destination and can observe unencrypted traffic, but it does not directly know the user’s source IP. HTTPS closes the content gap between browser and destination server. The lock icon therefore still matters on Tor.
Exit operators sometimes receive complaints because destination systems attribute traffic to their IP address. Serious operators publish exit policies, maintain abuse contacts, and often run relays through organizations that understand the role. Users should not conclude that exit traffic is automatically trustworthy or automatically dangerous. The correct assumption is: an exit is a potentially untrusted transport node, so end-to-end encryption is required.
Tor Browser and the Tor network are not the same
The Tor network is the infrastructure of relays, directory authorities, protocols, and software. Tor Browser is a browser built for that network. It does not only send traffic through Tor; it also reduces other identifying traits. Those include a standardized window presentation, website isolation, limited interfaces, and protection against tracking techniques.
An ordinary browser merely pointed at a Tor proxy does not get this protection automatically. Extensions, fonts, cookies, screen size, and active web features can create a distinctive fingerprint. Beginners should therefore get Tor Browser unchanged from the official source, update it promptly, and not personalize it with extra browser extensions.
Tor Browser isolates websites from one another, but it cannot repair an unsafe operating system. Malware with device access can read input, screen contents, or files before encryption. An opened document after download can also open external connections outside the browser. For sensitive documents, a controlled offline environment is better. At higher risk, purpose-built systems such as Tails or Whonix come into play, each after studying the official documentation.
Onion services
Tor can do more than reach ordinary websites. An onion service is reachable directly inside the Tor network and has a cryptographically derived address ending in .onion. Client and service each build separate circuits to a rendezvous point. The connection therefore needs no exit node, and neither side has to reveal its network address to the other.
Legitimate onion services are offered by media, human-rights organizations, search services, and infrastructure projects, among others. SecureDrop uses them for protected contact between whistleblowers and newsrooms. The Tor Project also publishes parts of its website as an onion service. An onion address does not automatically prove legitimacy. It must come from a verified primary source; search lists and random directories are not a reliable origin check.
The current third generation of onion services uses modern keys and long addresses. Typos usually produce an invalid address, but phishing remains possible if attackers circulate a similar-looking address. A bookmark saved after checking the official source is safer than repeatedly copying from other people’s posts.
Legitimate use cases
Journalists use Tor so that source research is less easily tied to a newsroom connection or location. Whistleblowers can make contact through correctly set-up systems. Human-rights organizations help people in censored networks reach independent information. Researchers study how websites respond from different network perspectives without revealing the same connection address for every request.
Everyday uses are legitimate too. Someone can research price or health information without tying a lasting advertising profile to their IP address. Travelers can reach news that is blocked locally. Administrators can check whether their site unnecessarily excludes Tor users. Survivors of stalking or domestic violence can treat network metadata as one piece of a safety plan.
Tor is not only a tool for extraordinary danger. Privacy benefits from a broad user base: when many different people use the network for ordinary purposes, any single use is less conspicuous. Laws still apply. Tor changes the transmission path, not the legal assessment of an act.
Limits and common misconceptions
Tor does not promise absolute anonymity. A powerful adversary who observes large parts of the internet at once can compare time and volume at the entry and the exit. Tor tries to make such traffic correlation harder, but it cannot fully prevent it against a global passive observer. Especially long, conspicuous, or uniquely timed connections raise the risk.
Application mistakes often matter more than protocol mistakes. Personal logins, reused pseudonyms, identical texts, document metadata, and mixing separated roles can create links. Using the same rare phrasing on the same day under a known name and a sensitive pseudonym is not fixed by a different IP address.
Tor is also not simply “a free VPN.” With a VPN the provider typically sees the source IP and can observe connection destinations unless further encryption applies. Tor spreads that information across several relays and avoids a single central trust point. In return Tor is slower, some services block exit addresses, and not every protocol suits the network.
Speed is a deliberate trade-off. Three relays, cryptographic processing, and worldwide detours increase latency. Large downloads or high-resolution streaming consume capacity provided by volunteers. BitTorrent over Tor is explicitly not recommended: many clients bypass proxy settings or leak identifying information, and the load harms other users.
Starting safely
The safest start is the official website torproject.org. Signed downloads and documentation are there. In blocked networks, confirm the address through trusted channels. After installation, automatic updates matter because browsers regularly close security-relevant holes.
For most people the defaults are sensible. The security levels “Standard,” “Safer,” and “Safest” progressively disable risky web features, but they can break websites. The highest level is not required in every situation; it should match the threat model. Extra add-ons and unusual configurations can make your own browser easier to distinguish.
Before sensitive use, decide which identities must stay separate. No personal accounts in the same context, no reused usernames, and no unchecked documents are simple baseline rules. Tor can support a good plan technically. It cannot decide which information in a text or photo is revealing.
Is Tor legal in Europe?
Generally yes in the EU, the UK, and most of Western Europe: the browser is not banned; the act remains unlawful. Geographic Europe is not one legal system — see Is Tor legal in Europe?.
Can Tor be traced?
A single relay operator should not see sender and destination at the same time. An adversary who observes large parts of the internet in parallel can compare time and volume at the entry and the exit. Application mistakes — logins, reused pseudonyms, document metadata — are more common than broken cryptography. See OPSEC fundamentals.
Conclusion
Tor is practical, publicly auditable infrastructure for reducing network observation and censorship. A circuit of guard, middle, and exit distributes knowledge of the connection. Onion routing ensures each relay receives only the information needed for its job. Tor Browser adds measures against tracking and fingerprinting on top of that network protection.
The benefit is real but limited: HTTPS, a clean endpoint, current software, and careful OPSEC remain necessary. Anyone who treats Tor as a building block rather than an invisibility button can make informed decisions. That sober framing is the basis of safe use.
Sources
- Tor Project: Tor Browser User Manual
- Tor Project: How Tor works
- Tor Project Support: About Tor
- Dingledine, Mathewson, Syverson: Tor: The Second-Generation Onion Router
- Electronic Frontier Foundation: Surveillance Self-Defense – Tor