What Is Tor Browser and How Does It Work?
Tor Browser is your gateway to anonymous internet browsing. It routes your traffic through multiple volunteer-operated servers (called relays) in different countries, encrypting your data at each layer. This process, called onion routing, makes it extremely difficult for anyone—ISPs, website operators, or government agencies—to connect your actions to your identity.
But Tor isn’t a magic cloak. It has real limitations that most users don’t understand. This guide explains how to use it properly and, more importantly, what it can’t do.
How Tor Routing Actually Works
When you connect to a website through Tor:
- Your computer connects to a Guard relay (entry point)
- The Guard relay connects to a Middle relay
- The Middle relay connects to an Exit relay
- The Exit relay connects to the destination website
Each layer only knows the layer before and after it—not the full path. Your ISP sees you connecting to a Guard relay but not what traffic goes through it. The website sees the Exit relay’s IP, not yours.
This works because of encryption at each layer. Your data is encrypted three times, with each relay stripping off one layer of encryption.
Getting Started: Installation and Configuration
Download Tor Browser
Visit www.torproject.org (not a mirror or link from elsewhere) and download Tor Browser for your OS. Verify the signature if you’re technically inclined (recommended).
Initial Setup
- Install Tor Browser like any other application
- Launch it—you’ll see a connection screen
- The browser will test your connection—you’ll see a green onion icon when connected
- The Tor Browser window opens—you’re anonymous now
First Configuration Steps
Check your IP. Visit check.torproject.org to verify that Tor is routing your traffic. You should see a green “Congratulations” message with an exit relay’s location (not your real location).
Don’t maximize the window. This is critical: keeping your Tor Browser window at a smaller size reduces the accuracy of browser fingerprinting. Tor recommends using the default window size.
Don’t resize to full screen. Sites can detect your screen resolution. A unique resolution can deanonymize you.
Safe Usage Practices
Use Standard Security Settings
Open Preferences > Privacy & Security and verify:
- Security Level is set to “Safer” at minimum (you can use “Standard” if needed)
- “Safer” mode disables JavaScript on all sites—this is a strong security choice
- “Safest” mode disables plugins and JavaScript universally
Start with “Safer” and only drop to “Standard” if a site doesn’t work.
Don’t Modify Tor Browser
Never:
- Install extensions or plugins (except those that come with Tor Browser)
- Change network settings in about:config
- Use other proxy settings alongside Tor
- Install separate VPNs with Tor
Each modification creates potential fingerprinting vectors that break Tor’s anonymity protections.
Connect to a Different Tor Circuit
To get a new IP address and route:
- Click the padlock icon > Change IP Address
- Tor disconnects and reconnects through new relays
- Check check.torproject.org to verify you have a new exit IP
Rotate circuits between sensitive actions to increase anonymity.
Disable Plugins and JavaScript
Visit about:blank in the address bar and then go to Preferences:
- Disable Adobe Flash (not installed by default, but disable if present)
- Disable Windows Media Player (Windows only)
- Under Security, set Security Level to “Safer” to disable JavaScript
JavaScript can leak your real IP. This is why Tor disables it by default in Safer mode.
What Tor Browser CANNOT Protect You From
This is critical. Tor provides anonymity from network eavesdropping, but it’s not invincible.
Website Fingerprinting
Even through Tor, a sophisticated observer can analyze the size and timing of packets you send to identify patterns. This is called website fingerprinting. A researcher could potentially identify that you visited Facebook based on packet patterns, even though your IP is hidden.
Mitigation: Use Tor with a VPN (see below), keep the window in standard size, and don’t maximize it.
Endpoint Attacks
If you use Tor to visit a website controlled by an attacker (like law enforcement running a honeypot site), they can potentially identify you through JavaScript exploits, Flash, or plugins.
Mitigation: Use Security Level “Safer” to disable JavaScript. Keep Tor Browser updated. Never grant Tor Browser special permissions.
Malware and Phishing
Tor doesn’t protect against malware downloads or phishing attacks. If you download a file that contains malware, Tor won’t help you.
Mitigation: Don’t download executables from unfamiliar sources. Verify file signatures when possible. Assume every click is a potential attack.
Traffic Analysis at Exit Relay
The Tor exit relay can see unencrypted traffic. If you visit an HTTP site (not HTTPS), the exit relay operator can see what you’re doing.
Mitigation: Always use HTTPS sites. Most sites redirect HTTP to HTTPS automatically, but verify the padlock is showing.
NSA/Nation-State Adversaries
The NSA has documented Tor weaknesses. While Tor is still extremely effective against commercial surveillance, nation-state adversaries with massive infrastructure might correlate timing and traffic patterns across multiple Tor relays to track users.
Mitigation: There’s no perfect mitigation, but combining Tor with a trustworthy VPN, using bridges, and minimizing time spent on activities increases difficulty.
Advanced: Using Bridges and Pluggable Transports
If your ISP or government blocks Tor, you can use Tor bridges—relays not listed publicly. This hides the fact that you’re using Tor.
Getting Bridges
- Visit bridges.torproject.org
- Solve the CAPTCHA
- Choose bridge type: obfs4 (best), meek, or standard bridges
- Copy the bridge addresses
Configuring Bridges in Tor Browser
- Open Tor Browser Preferences > Connection
- Select “Use a bridge”
- Select “Provide a bridge I know”
- Paste your bridge addresses
- Click “Connect”
Tor Browser will now use bridges to hide your Tor usage.
Tor + VPN: When and Why
Combining Tor with a VPN is debated. The approach depends on your threat model:
VPN Before Tor (VPN → Tor): Your VPN provider sees you using Tor but not where you’re going. The Tor exit relay sees your traffic but not your real IP. Use this if you trust your VPN provider and want to hide Tor usage from your ISP.
Tor Before VPN (Tor → VPN): You route through Tor first, then a VPN. This is less common because the VPN can see your Tor exit IP, potentially deanonymizing you.
Configuration (VPN First):
- Connect to your VPN
- Launch Tor Browser
- Connect to Tor normally
Common Mistakes to Avoid
Using Tor with a clearnet social media account. If you log into Facebook through Tor, Facebook now knows your account is accessed via Tor. Your other logins on that account (from your real IP) immediately reveal your identity.
Filling out forms with real information. Never submit your real name, email, or identifying information through Tor while anonymous.
Torrenting through Tor. BitTorrent protocols ignore Tor and leak your real IP. Don’t torrent through Tor.
Running JavaScript with unsafe settings. JavaScript can be weaponized to reveal your IP or fingerprint you. Keep the security level high.
Staying logged into accounts across multiple identities. Keep your Tor-accessed identities completely separate from your real-world identities.
When to Use Tor
- Accessing information in censored regions
- Researching sensitive topics without ISP monitoring
- Whistleblowing or contacting journalists
- Protecting yourself from commercial tracking
- Accessing .onion services
Tor Is a Tool, Not a Guarantee
Tor provides powerful anonymity, but no tool is perfect. Your behavior matters more than your tools. Logging into your real identity through Tor defeats the entire purpose. Using Tor to access a site controlled by law enforcement while downloading files from it, expecting to remain anonymous, is a mistake.
Tor is most effective when paired with operational security discipline—thinking before you click, minimizing identifying information, and understanding that anonymity requires constant vigilance.
Use Tor thoughtfully, understand its limitations, and respect that it’s a tool for privacy, not permission to break laws.