Tor: how onion routing works, and what it does not protect

Tor, short for “The Onion Router”, is free software and a volunteer-run network that makes it much harder to link what you do online to who you are. It was originally developed from research at the US Naval Research Laboratory and is now maintained by the Tor Project, a non-profit organisation. Journalists, human rights workers, people living under censorship and ordinary privacy-conscious users rely on it every day. Criminals use it too, which is why it has a complicated reputation.

How onion routing works

Normally, when you visit a website, your internet provider can see which site you are contacting, and the site can see your IP address, which points roughly to where you are. Tor breaks that link. The Tor Browser sends your traffic through three volunteer-run relays chosen from thousands around the world, and it wraps the traffic in three layers of encryption, like the layers of an onion.

• The entry (guard) relay knows your IP address but not what you are visiting.
• The middle relay knows neither who you are nor where you are going; it only passes traffic between the other two.
• The exit relay knows the site you are visiting but not who you are.

Each relay removes one layer of encryption, learns only the next hop, and passes the rest along. No single relay knows both who you are and what you are doing. Onion services, the sites with .onion addresses, go one step further: the traffic never leaves the Tor network, so the site’s location is hidden too.

Who uses Tor, and why

• People in countries that censor or monitor the internet, to reach news and communicate.
• Journalists and their sources, including through secure drop systems run by news organisations.
• Activists, researchers and domestic-abuse survivors who need to avoid being tracked.
• Ordinary users who do not want advertisers or their network provider to profile their browsing.

What Tor does not protect

The Tor Project is direct about its limits. Asked whether Tor makes you totally anonymous, its own support pages answer no, and list the ways people give themselves away. Tor protects the route your traffic takes; it cannot protect you from what you reveal yourself.

Why some networks treat Tor traffic with suspicion

From the point of view of a website or a company network, all Tor users look the same: traffic arrives from a small set of known exit relays whose addresses the Tor Project publishes in a public list. Because attackers also use Tor to hide where they are, many services add friction for Tor visitors, such as extra verification steps, and many security teams watch for unexpected connections to or from Tor. On a work computer, a program you did not install quietly connecting through Tor can be a sign of malicious software trying to hide where it sends data.

Seeing Tor traffic on your own Mac

FireAI can help you tell the difference between Tor you chose to use and Tor you did not. With its optional threat lists turned on (they are off by default), FireAI downloads the Tor Project’s public exit list. When you investigate a connection, it tells you whether the other end is a Tor exit relay, and it counts that as one of the risk signals it weighs, alongside which app made the connection. If it is Tor Browser, that is expected. If it is an app you do not recognise, you can block it. FireAI does not block Tor on its own, and it does not weaken the anonymity of Tor Browser: the check happens locally on your Mac.

Using Tor safely

• Download Tor Browser only from the Tor Project’s official website, and keep it updated.
• Do not log into accounts that identify you while you need to stay anonymous.
• Do not install extra browser add-ons: they can make your browser stand out or leak information.
• Prefer sites that use HTTPS, so the exit relay cannot read what you send.
• Open downloaded documents only after disconnecting, or in a separate environment: some file types can fetch content from the internet directly, outside Tor.
• If you face serious risks, such as a hostile government, read specialist guidance like the EFF’s Surveillance Self-Defense before relying on any single tool.

Tor, VPNs and proxies

A VPN moves your trust from your internet provider to one VPN company, which can see your traffic and knows who you are. Tor spreads that trust across three independent relays so that no single one sees the whole picture. Tor is slower and some sites block it; a VPN is faster and simpler but requires trusting its operator. The earlier course on how the internet works compares them in more detail.