How Tor Works — Anonymous Internet Explained
Photo: Efe Burak Baydar / Pexels
Tor — The Onion Router — is the world's most widely used anonymity network. About two to three million people connect to it on a given day, ranging from journalists and dissidents to ordinary users tired of being tracked, plus a much smaller population of operators on the network's dark-web side.
It's also one of the most misunderstood technologies on the internet. Tor isn't a VPN, it isn't a magic invisibility cloak, and it doesn't make you anonymous if your behavior gives you away. What it actually does is more interesting — and more limited — than the marketing usually suggests.
Origins in a US Navy lab
Tor wasn't born in a hacker basement. It came out of the US Naval Research Laboratory in the mid-1990s, where mathematicians Paul Syverson, David Goldschlag, and Michael Reed were trying to solve a specific problem: how do you protect the metadata of US government communications? If an adversary monitors a network and sees a CIA office talking to a particular embassy, that's intelligence even without reading the content.
Their answer was onion routing — wrapping a message in multiple layers of encryption so that no single relay knows both the source and destination.
In 2002, the open-source reference implementation, "Tor," was released. Roger Dingledine and Nick Mathewson took over development. Today the Tor Project is a US nonprofit funded by a mix of US government grants (yes, still), private foundations like the Mozilla Foundation, donations, and the Open Technology Fund.
The somewhat absurd consequence: the US government simultaneously funds Tor's development and tries to deanonymize people using it.
Onion routing in plain terms
Imagine you want to send a letter to a friend without the postal service learning who you are.
- You write your letter.
- You put it in an envelope addressed to your friend.
- You put that envelope in a second envelope addressed to a stranger in another city, with instructions: "Please open and mail the inner envelope."
- You put that envelope in a third envelope addressed to a stranger in yet another city, with the same instructions.
- You hand the package to a fourth stranger.
The first stranger sees only the outer address. The middle stranger sees only the second address. The exit stranger sees only the final address — and the letter — but doesn't know it came from you. Nobody knows the full chain.
That's onion routing. In Tor's case:
- Your traffic is encrypted in three layers.
- It's sent through three randomly chosen volunteer relays: an entry guard, a middle relay, and an exit node.
- Each relay peels off one layer of encryption, learning only the previous and next hop.
- The exit node decrypts the final layer and sends your request to its real destination on the regular internet.
- The destination sees a request from the exit node's IP, not yours.
The entry guard knows who you are but not where you're going. The exit knows where you're going but not who you are. The middle knows neither.
The network in numbers
Volunteers run roughly 7,000–8,000 active relays worldwide. About 2,000 of these are exit nodes — relays willing to take the legal heat of being the visible source of exit traffic. Tor's metrics portal tracks roughly two to three million daily clients.
You access Tor most easily through Tor Browser, a modified Firefox preconfigured to route everything through the network and with a long list of fingerprinting protections enabled. Every Tor Browser user looks similar in the browser-fingerprint sense, which is a privacy property you can't easily get any other way.
Bridges and pluggable transports
Countries that don't want their citizens using Tor — China, Iran, Russia, and others — block the public list of Tor relay IPs. The Tor Project's response is bridges: unlisted entry relays distributed quietly by email, Telegram bot, or in-app request.
If even bridges get blocked, pluggable transports disguise the traffic itself. obfs4 makes Tor traffic look like random noise. meek tunnels it through major cloud CDNs. Snowflake routes traffic through volunteers' web browsers via WebRTC, making it look like a video call. The censor must either block the underlying internet service (which has political costs) or let Tor through.
Tor vs. VPN vs. I2P
| Feature | Tor | Commercial VPN | I2P |
|---|---|---|---|
| Hops | 3 (minimum) | 1 | Multiple, varies |
| Trust model | Trustless — no single party knows source + destination | Trust the VPN provider | Trustless within network |
| Speed | Slow (typically 1–20 Mbps) | Fast (near native) | Variable |
| Anonymity | Strong against most adversaries | Only as good as the provider | Strong; smaller user base |
| Exit to public internet | Yes, via exit nodes | Yes | Limited |
| Hidden services | Yes (.onion) |
No | Yes (.i2p "eepsites") |
| Best for | High anonymity, censorship circumvention | Streaming, region-shifting, basic privacy | Hidden-service-focused activity |
| Cost | Free | $5–$15/month | Free |
A VPN is a single hop. You trade trusting your ISP for trusting your VPN provider. Tor distributes trust across three independent operators in three jurisdictions — no single party can connect you to your destination.
What Tor doesn't protect against
Tor is not a magic privacy cloak. Several real threats remain:
- Malicious exit nodes: an exit node sees the unencrypted final hop. If you're browsing a site over plain HTTP, the exit operator can read or modify it. Always use HTTPS. Tor Browser ships with HTTPS-Only mode by default.
- Traffic correlation: a powerful adversary who can observe both the entry into Tor (your ISP) and the exit out (the destination's network) can statistically correlate traffic timing and volume to deanonymize you. The Snowden documents revealed that NSA and GCHQ ran experiments along these lines with mixed success.
- Browser fingerprinting: outside of Tor Browser, using regular browsers over Tor is dangerous because your browser's unique fingerprint can identify you.
- Operational mistakes: logging into your real-name accounts, mentioning identifying details, downloading documents that phone home. The vast majority of high-profile Tor deanonymizations have been opsec failures, not breaks of the protocol itself.
Ross Ulbricht, founder of the Silk Road marketplace, was identified in 2013 because he used the same username on a clearnet forum and on Silk Road early in its history — a classic opsec failure. The protocol held; the human didn't.
Hidden services and .onion
Tor's other half is hidden services — servers whose IP addresses are themselves hidden, accessible only through .onion addresses. These are not random domains; they're cryptographic identifiers derived from the server's public key. Version-3 .onion addresses are 56 characters long and authenticated end-to-end.
.onion isn't just dark-web markets. Major outlets run mirrors:
- The New York Times:
nytimes3xbfgragh.onion(and others) - BBC: provides an
.onionfor readers in censored countries - ProPublica: first major news outlet with a
.onion - Facebook: maintains
facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onionfor users in countries that block Facebook
The same technology that enables marketplaces also enables press freedom.
For more on the underlying cryptography, see our piece on how encryption works. And on broader implications, see AI safety and surveillance.
Adjacent tools
- Tails OS: a Linux live distribution designed to be booted from a USB stick. Routes everything through Tor and leaves no trace on the host computer after shutdown. Used by Edward Snowden in 2013.
- Whonix: a two-VM setup where one VM handles networking through Tor and the other runs applications, isolated from the host network.
- Mullvad Browser: a Tor-Browser-derived browser without the Tor network — gets you fingerprint resistance without the latency, if you trust a single VPN.
Who actually uses Tor?
Surveys and the Tor Project's own outreach materials suggest the bulk of users are:
- Privacy-conscious ordinary people avoiding ad tracking
- Journalists protecting sources
- Activists in repressive countries
- Researchers studying censored content
- Whistleblowers using SecureDrop (a Tor-based tip-line platform deployed at most major newsrooms)
A minority of traffic relates to dark-web markets and illicit activity. Multiple academic studies have estimated this fraction; methodologies vary widely, but the consensus is that illegal use is a real but minority component.
FAQs
Q: Is using Tor illegal? A: In most countries, no. Some authoritarian governments criminalize or restrict Tor usage. Even where legal, doing illegal things over Tor is still illegal.
Q: Can the government see what I do on Tor? A: They can see that you're connecting to Tor (unless you use bridges and pluggable transports). What you do inside Tor is harder to see, but vulnerable to traffic correlation by powerful adversaries watching both ends.
Q: Is Tor better than a VPN? A: For anonymity, yes — Tor distributes trust across three independent relays in three jurisdictions; a VPN concentrates trust in one provider. For speed, no — Tor is much slower. Use the right tool for the job.
Q: Can Tor be broken? A: The protocol itself has held up well. Deanonymizations almost always come from traffic correlation by very well-resourced adversaries, user opsec failures, or vulnerabilities in the Tor Browser (Firefox) rather than the network protocol.
Q: Why does the US government fund Tor? A: Anonymity is most useful when many people use the network. A network used only by US intelligence agents would be useless; a network used by millions of ordinary people, journalists, and activists provides cover for everyone, including those agents.
Q: What's the dark web? A: "Dark web" usually refers to hidden services accessible only through Tor or similar networks. It includes both legitimate sites (mirrors of news outlets, secure tip-lines) and illicit ones. It's a small subset of the broader "deep web," which just means anything not indexed by search engines.
Sources
- Dingledine, R., Mathewson, N., & Syverson, P. (2004). Tor: the second-generation onion router. USENIX Security Symposium.
- Tor Project. (2025). Tor Metrics. metrics.torproject.org.
- Syverson, P. (1999). Onion routing for resistance to traffic analysis. Naval Research Laboratory.
- Greenberg, A. (2017). Sandworm and reporting on Tor in Wired.
- Owen, G., & Savage, N. (2015). The Tor Dark Net. Global Commission on Internet Governance.
- Snowden, E., as reported by Greenwald, G. (2014). No Place to Hide.
Read next:
Follow new articles
Add SciHub101 to your feed reader to see new science and technology stories.
About the Author
SciHub101 is an independent science and technology publication founded and edited by Buğra Sözeri, a software engineer and app developer based in Türkiye. AI tools assist with drafting and research. Source documentation in the existing archive is uneven, and articles are being reviewed and corrected. The Editorial Team byline identifies editorial responsibility; it does not certify specialist or independent human review. Where we compare products, anything built by our own team is labelled as such — see the editorial guidelines and About page for how corrections and disclosures work.
Related Articles
How LiDAR Works — Laser 3D Mapping
LiDAR fires millions of laser pulses per second to build 3D point clouds. It powers self-driving cars, iPhones, and the discovery of lost Maya cities.
How VPN Works — Virtual Private Networks
How VPNs work: encrypted tunnels, protocols (WireGuard, OpenVPN, IKEv2), top providers in 2026, limitations, and how they compare to Tor.
How Facial Recognition Works: From Pixels to Face Embeddings
Facial recognition turns a face into a short list of numbers and compares it with stored lists. Here is how detection, embeddings, and thresholds work, and why error rates differ across groups and settings.
How Social Engineering Hacking Works — Why Humans Are the Weakest Link
The most sophisticated cyberattacks don't exploit code — they exploit people. Here's how phishing, pretexting, spear phishing, and vishing manipulate human psychology to bypass any technical defense.
How Ransomware Works — The Cybercrime That Shuts Down Hospitals
Ransomware has crippled hospitals, pipelines, and governments. Here is the technical reality of how attackers get in, encrypt files, steal data, and get paid, and which defenses hold up.
How Passwords Are Hacked — And How to Stop It
Your password might already be sitting in a leaked list. Here's how hackers crack, steal, and reuse credentials, and the science behind stopping them.