PlayInfoBox

Home /Network /What Is the Tor Network? How It Works and Its Limitations

What Is the Tor Network? How It Works and Its Limitations

Layered encryption that hides who's connecting to what β€” here's how the Tor network actually works.

What the Tor network is

Tor (The Onion Router) is a free, open-source network that routes your internet traffic through a randomly selected series of volunteer-run relay servers instead of sending it directly to its destination, making it much harder to trace who connected to which site.

How onion routing works

Before sending data, the Tor client wraps it in multiple layers of encryption, one for each relay it will pass through. Each relay peels off only its own outer layer, learns just the address of the next hop, and passes the message on β€” no single relay knows both the full path and the original content. This layered structure is where the 'onion' name comes from.

The three-hop relay structure: guard, middle, exit

Tor traffic typically passes through three relays: a guard node that serves as the entry point, a middle node that relays it once more, and an exit node that finally sends it out onto the regular internet. Each relay only knows the node immediately before and after it, not the full path, so compromising a single relay generally isn't enough to link a user to their destination.

'.onion' addresses and hidden services

Addresses ending in .onion are reachable only within the Tor network and let a service keep not just its visitors anonymous, but its server's real location hidden too. These are called hidden services (or onion services) β€” used for legitimate purposes like secure tip lines for journalists, but also, unfortunately, abused by illicit sites trying to avoid detection, which is worth knowing about.

Why people use Tor

Tor is used to circumvent internet censorship in places where access is monitored or restricted, by journalists communicating safely with anonymous sources, and by individuals who simply want to keep their browsing activity harder to track by their internet provider or by ad networks. It's worth understanding that this same anonymity is sometimes misused for illegal purposes as well.

Speed trade-offs and security limits

Routing through several relays makes Tor noticeably slower than a normal internet connection. Exit nodes also handle your traffic after it leaves Tor's encrypted portion, so if the site you're visiting doesn't use HTTPS, the exit node operator could potentially see the contents of that traffic. Tor significantly boosts anonymity, but it isn't an absolute guarantee against a well-resourced attacker doing traffic analysis.

How to access it, and how it differs from a VPN

The usual way to use Tor is the official Tor Browser, which builds its relay path automatically with no complex setup required. Where a VPN routes all your traffic through a single provider's server, Tor spreads it across multiple independent, volunteer-run relays β€” meaning trust is distributed across many operators rather than concentrated in one VPN company.

Where Tor came from

Onion routing was developed in the mid-1990s by researchers at the US Naval Research Laboratory. The alpha version of the Tor software appeared in 2002, and the nonprofit Tor Project was founded in 2006 to maintain it. Tor Browser, a modified version of Firefox ESR, packages the network access with privacy-focused browser settings. The network has historically received a large share of its funding from US government sources and from foundations, and because the software is open source, anyone can inspect the code.

Circuits and how often they change

A path through the network is called a circuit. Tor Browser builds a circuit when you start, and by default switches to a new one for new connections roughly every ten minutes, so different sites you visit are usually kept on separate circuits. The first relay, the guard, is deliberately kept stable for a longer period, because constantly picking new entry points would increase the chance of eventually choosing a malicious one.

Bridges and pluggable transports

The list of public Tor relays is public, so governments can block them. To get around this, Tor offers bridges, which are relays that are not listed publicly, together with pluggable transports such as obfs4 and Snowflake that disguise Tor traffic so it looks like something else. Users in heavily filtered networks can request bridge addresses and select a transport from within Tor Browser settings.

What Tor Browser does beyond routing

Tor Browser separates cookies and cache by site, resists browser fingerprinting by making many users look alike, and applies a standardized window size approach so that screen dimensions reveal less. Because the protections depend on all users looking similar, installing extra add-ons or resizing the window to unusual sizes can make you more distinctive, which works against the point.

Habits that undo anonymity

The weak link is usually the user, not the network. Logging in to an account tied to your real name, uploading a file with identifying metadata, opening downloaded documents outside Tor Browser, or reusing a username from another site can all link a session back to you. Torrenting over Tor is discouraged because many clients leak your real address and it burdens the network.

How onion addresses look and why

Current onion service addresses are long strings of 56 characters ending in .onion, derived from the service's public key. Because the address is also the key, visitors know they reached the right service without relying on a certificate authority. Several mainstream organizations, including news outlets and search or social services, operate onion versions of their sites for people in restricted regions.

How Tor differs from a VPN, in practice

A VPN encrypts your traffic to a single server run by one company, meaning that company (in principle) could see your traffic and knows both who you are and what you're doing, even if they promise not to look. Tor spreads that trust across three independent, volunteer-operated relays instead β€” no single relay operator can see both who you are and what site you're visiting, which is the core of its anonymity model. The trade-off is speed: Tor is almost always slower than a VPN because of the extra hops.

Who actually keeps the network running

Tor relays are run by thousands of volunteers, organizations, and universities around the world, coordinated by the Tor Project, a nonprofit. Anyone with a spare server and enough bandwidth can run a relay, which is precisely what gives Tor its distributed trust model β€” there's no single company or government that operates or controls the whole network.

Who benefits and who gets blocked

Besides activists and journalists, ordinary people use Tor to keep a shared household connection, a workplace network, or an advertiser from building a record of their browsing. A practical downside is that some websites treat exit relays as suspicious, so you may see extra CAPTCHAs, block pages, or refused logins, since abusive traffic can come from the same shared exit addresses. Some banks and streaming services block Tor traffic entirely.

Legal and ethical context

Running a relay that only passes traffic between other relays is generally low risk, whereas running an exit relay can bring abuse complaints because the traffic appears to originate from your address. Laws vary by country, and a few governments restrict or block Tor. This is general information and not legal advice, so check the rules where you live before using or running Tor.

Frequently Asked Questions

Does using Tor make me completely anonymous?

It significantly increases anonymity, but not absolutely. If you log into an account with identifying details while using Tor, or if a well-resourced adversary is able to analyze traffic patterns at scale, your identity can still potentially be exposed.

Is it illegal to use Tor?

No. Tor itself is an open-source tool built for legitimate purposes like press freedom and privacy protection, and using it is legal in most countries. Actually committing illegal acts using Tor, however, remains illegal, just as it would through any other tool.

Should I use Tor and a VPN together?

For most people it is not necessary and can add complexity. A VPN before Tor hides your use of Tor from your internet provider but makes the VPN company a trusted party that sees your real address. If your goal is to avoid network-level blocking, Tor bridges are usually the intended solution.

Where should I get Tor Browser?

Download it only from the official Tor Project website, and verify you are on the right domain before downloading. Fake download sites and modified copies exist, and a tampered browser defeats all the protections described above.

Why is Tor so slow?

Each request travels through three volunteer-run relays that may be located on different continents and carry traffic from many other people. Latency adds up, and the available bandwidth depends on volunteer capacity. Video streaming and large downloads are impractical, while text browsing and messaging generally work.