Tor Network Complete Guide
Master the onion router network for true anonymous browsing and communications
Current Version: Tor Browser 15.0.24 (September 29, 2026)
Built on Firefox 140.17.0esr with tor 0.4.9.13 and NoScript 13.6.35. HTTPS-Only Mode is on by default, and the browser ships with Tor's anti-fingerprinting patches. The network runs on roughly 7,000-8,000 volunteer relays worldwide.
- Heads up, 32-bit and older Android users: Tor Browser 15.0 is the last series supporting 32-bit x86 Linux/Android and Android 5.0-7.0. Tor Browser 16.0 (currently in alpha, built on Firefox 153 ESR) drops them.
- Windows download lag: the Windows installer on the download page is temporarily behind (15.0.20) while the Tor Project renews its code-signing certificate. Existing installs still auto-update to the latest release.
- New signing subkey: if you verify downloads manually, refresh the Tor Browser signing key before verifying (step 2 below).
Last verified: October 2026
Understanding The Onion Router
Tor (The Onion Router) uses onion routing to encrypt and reroute web traffic through multiple network nodes. Each relay peels away a layer of encryption, obscuring your origin by the time data reaches its destination.
Multi-Layer
Multiple encryption layers
Random Path
Randomized routing through relays
Anonymous
Origin obscured from destination
How Tor Network Functions
Entry Guard
First relay in the circuit, knows your IP but not destination
Middle Relay
Intermediate hop, knows neither source nor destination
Exit Node
Final relay, knows destination but not your IP
Circuit Path: Your traffic passes through three randomly selected relays, with each relay only knowing the previous and next hop in the chain. This creates a secure tunnel where no single relay can connect you to your destination.
Tor Browser Installation & Setup
1Download from Official Source
Always download from the official Tor Project website to avoid malicious versions:
Official URL:
https://www.torproject.org/download/• Choose your operating system (Windows, macOS, Linux, Android)
• Download the latest stable release (currently 15.0.24)
• Also download the matching .asc signature file
• File size is roughly 100-150 MB depending on platform
Security Note:
Never download Tor Browser from third-party sites, torrents, or random app store listings. Fakes bundled with malware are common. On Android, use only the official Tor Project listings (Google Play publisher "The Tor Project", the Guardian Project F-Droid repo, or torproject.org).
2Verify Digital Signature (Recommended)
Signature verification ensures your download hasn't been tampered with:
1. Download the .asc signature file from the same page as the browser
2. Install GPG if you don't have it: gpg --version
3. Fetch (or refresh) the Tor Browser Developers signing key:
gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org4. Export it to a keyring file:
gpg --output ./tor.keyring --export 0xEF6E286DDA85EA2A4BA7DE684E2C6E87932982905. Verify the download against its signature (both files are required):
gpgv --keyring ./tor.keyring tor-browser-linux-x86_64-15.0.24.tar.xz.asc tor-browser-linux-x86_64-15.0.24.tar.xz6. Look for Good signature from "Tor Browser Developers (signing key)"
Swap the filename for your platform (.exe on Windows, .dmg on macOS). If gpgv reports an unknown subkey, re-run step 3 to refresh.
3Installation Process
Windows
- • Run the .exe installer
- • Choose installation location (a USB stick works for a portable copy)
- • Launch "Tor Browser" from the Start menu or install folder
- • Updates install automatically from inside the browser
macOS
- • Open the .dmg file
- • Drag Tor Browser to Applications
- • Launch normally: the app is signed and notarized, so no right-click workaround is needed
- • If macOS still blocks it, approve it in System Settings > Privacy & Security
Linux
- • Extract:
tar -xf file.tar.xz - • cd tor-browser
- • Run:
./start-tor-browser.desktop - • Register in app menu:
./start-tor-browser.desktop --register-app - • Alternatives:
torbrowser-launcherfrom your distro or Flathub (downloads and verifies the official build for you)
4First Launch Configuration
Connection Options:
✓ Connect (Most Users):
Choose this if Tor isn't blocked where you are. Tick "Always connect automatically" if you want to skip this screen next time.
⚙ Configure Connection (Censored Areas):
If the connection fails, Connection Assist offers to pick a bridge for your location automatically. You can also add bridges manually (see Bridge Configuration below).
Security Level (Accessible via Shield Icon):
Standard: Default security, all website features work
Safer: Disables JavaScript on non-HTTPS sites, some fonts and math symbols disabled, audio/video click-to-play
Safest: JavaScript disabled on all sites, some fonts, icons and images disabled, audio/video click-to-play
Onion Services & Hidden Sites
1Understanding .onion Addresses
Onion addresses are special URLs that end in .onion instead of .com or .org. Traffic never leaves the Tor network, so both you and the site stay hidden:
v3 Onion Address Format:
duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion- • 56 characters before .onion (v3 format)
- • Derived from the service's public key
- • Can't be hijacked, but look-alike phishing addresses exist
- • No DNS lookup: resolved entirely inside Tor
Six-Hop Circuit:
Hidden services use 6 hops instead of 3:
- • You → Guard → Middle → Rendezvous
- • Service → Guard → Middle → Rendezvous
- • Neither party knows the other's location
- • No exit node involved: encrypted end to end inside Tor
2Finding Legitimate Onion Services
Trusted Sources for Onion Links:
Best: Let the Site Tell You
- • Many sites send an Onion-Location header: Tor Browser shows a purple ".onion available" button in the address bar
- • Check the organization's own website for its onion link
- • Some onion sites also carry HTTPS certificates that name the onion address
Curated Lists:
- • Tor Project's own onion services list (torproject.org)
- • "Real-World Onion Sites" on GitHub (alecmuffett), a vetted list of mainstream sites
- • Avoid "Hidden Wiki" style link dumps: full of phishing clones and scams
- • Cross-reference any address with at least two trusted sources
Warning: Many onion link directories contain scams, malware, and illegal content. Only visit onion services you specifically need and have verified through official channels.
3Accessing Hidden Services Safely
Connection Process:
- 1.Copy the full .onion address exactly (case-sensitive)
- 2.Paste into Tor Browser address bar
- 3.Wait for connection (may take 10-30 seconds)
- 4.Verify you're on the correct site before interacting
Common Legitimate Onion Services (v3):
DuckDuckGo: duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion
Proton Mail: protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion
BBC News: bbcnewsd73hkzno2ini43t4gblxvycyac5aw4gnv7t2rccijh7745uqd.onion
* v2 onion addresses (16 characters) stopped working in 2021. Always confirm addresses on the organization's own site.
4Security & Safety Guidelines
❌ Never Do:
- • Download files from unknown onion sites
- • Enable JavaScript on unfamiliar services
- • Enter personal information
- • Browse random onion link directories
- • Access illegal marketplaces or content
✓ Best Practices:
- • Bookmark verified onion addresses
- • Use highest security level for unknown sites
- • Cross-reference addresses from multiple sources
- • Onion sites don't need HTTPS: the onion connection is already encrypted end to end
- • Exit immediately if site seems suspicious
Bridge Configuration & Censorship Bypass
1Understanding Bridge Relays
Bridges are special Tor relays that aren't listed in the public directory. They help you connect to Tor when it's blocked:
Why Bridges Are Needed:
- • Countries block known Tor relay IP addresses
- • ISPs can detect Tor traffic patterns
- • Bridges provide unlisted entry points
- • Pluggable transports disguise traffic
Bridge Types:
obfs4 (Try First)
Makes traffic look like random data
WebTunnel (Try Next)
Disguises Tor as ordinary HTTPS traffic to a normal-looking website
Snowflake (Built-in)
Uses short-lived volunteer proxies over WebRTC. No address needed
meek (Built-in, Last Resort)
Routes through a large CDN. Slow, but hard to block
2Getting Bridge Addresses Securely
Method 1: Inside Tor Browser
- 1.Easiest: if connecting fails, let Connection Assist choose a bridge for your location
- 2.Or open Settings > Connection > Bridges
- 3.Pick a built-in bridge (Snowflake or meek), or click "Request bridges" to get fresh ones from torproject.org after a CAPTCHA
- 4.Click Connect and watch the status in the Connection panel
Method 2: Out-of-Band (When torproject.org Is Blocked)
Website:
- 1. Visit bridges.torproject.org
- 2. Choose obfs4 or WebTunnel
- 3. Solve the CAPTCHA
- 4. Copy the bridge lines
Telegram:
- • Start a chat with @GetBridgesBot
- • Follow its prompts to request bridges
- • Copy the lines it returns
Email:
- • Email bridges@torproject.org
- • Send from a Gmail or Riseup address only
- • Bridge lines arrive in the auto-reply
3Configuring Bridge Connection
Manual Bridge Configuration:
- 1.Open Tor Browser settings (hamburger menu → Settings)
- 2.Select "Connection" in the left sidebar
- 3.Under Bridges, click "Add a bridge manually"
- 4.Paste your bridge lines (one per line) and confirm
- 5.Restart the connection if prompted
Bridge Line Formats (placeholder values):
obfs4 bridge:
obfs4 192.0.2.1:443 0123456789ABCDEF0123456789ABCDEF01234567 cert=AbCd...xyz iat-mode=0WebTunnel bridge:
webtunnel [2001:db8::1]:443 0123456789ABCDEF0123456789ABCDEF01234567 url=https://example.com/secret-path ver=0.0.1Snowflake and meek are built in. You select them from the list, no bridge line required.
4Testing & Troubleshooting Bridges
✓ Connection Success Signs:
- • Tor circuit builds successfully
- • Browser shows connected status
- • Can access websites normally
- • Connection logs show bridge usage
- • No error messages in connection status
⚠ Troubleshooting Steps:
- • Try different bridge addresses
- • If obfs4 fails, try WebTunnel, then Snowflake, then meek
- • Check bridge format is correct
- • Restart Tor Browser completely
- • Use VPN + bridge combination if needed
Note: Bridge connections may take longer to establish (30-60 seconds). If one bridge fails, try others from your list. Some countries block specific bridge types more aggressively than others.
Security Level Configuration
1Accessing Security Settings
Tor Browser includes three security levels that trade website features for a smaller attack surface:
- 1.Click the shield icon in the toolbar (right of the address bar)
- 2.Click "Change" (or "Settings") in the panel
- 3.Alternatively: Settings > Privacy & Security > Security Level
- 4.Choose Standard, Safer, or Safest. Some changes need a browser restart
Screenshot Placeholder:
Tor Browser Shield Icon Location
2Understanding Security Levels
Standard Security
What's Enabled:
- • JavaScript enabled on all sites
- • Audio and video playback works
- • WebGL and fonts load normally
- • All website features function
Best For:
- • General browsing and research
- • Sites requiring full functionality
- • Users new to Tor
- • Maximum compatibility needed
Safer Security
What's Disabled:
- • JavaScript on non-HTTPS sites
- • Some fonts and math symbols
- • Audio and video become click-to-play
- • Some performance optimizations (JIT) off
Best For:
- • Moderate security needs
- • Browsing unknown websites
- • Mixed HTTP/HTTPS content
- • Balanced security/usability
Safest Security
What's Disabled:
- • JavaScript disabled on all sites
- • Audio and video click-to-play
- • Some fonts and icons blocked
- • Some images may not load
Best For:
- • Maximum security required
- • Sensitive research
- • High-risk environments
- • Text-only browsing acceptable
3NoScript: Let the Security Level Drive It
Tor Browser bundles NoScript, but the security level controls it for you. Its toolbar icon is hidden by default on purpose:
- 1.Leave NoScript alone and pick a security level instead
- 2.On Safer/Safest, click-to-play placeholders let you load a single blocked video once
- 3.If you must, add NoScript to the toolbar via the Customize Toolbar menu
- 4.Avoid permanent "Trusted" site exceptions
Every custom NoScript rule makes your browser behave differently from other Tor users, which makes you easier to fingerprint.
Screenshot Placeholder:
NoScript Interface & Options
4Security vs Usability Trade-offs
Common Scenarios & Recommendations:
Research & Reading:
Use Standard or Safer level. Most content works fine.
Streaming & Media:
Requires Standard level. JavaScript needed for players.
High-Risk Activities:
Use Safest level. Accept limited functionality for maximum security.
Online Shopping:
Avoid through Tor. Use regular browser with VPN instead.
Pro Tip: The security level applies to the whole browser, not per site. If one site needs Standard, switch down, use it, then switch back to Safer or Safest (or use New Identity to start clean).
Operational Security (OPSEC)
1Keep Identities Separate
- • Never log into accounts tied to your real name (Google, Facebook, work email, banking) in Tor Browser
- • Create separate accounts for anonymous activity and only ever use them over Tor
- • Don't reuse usernames, avatars, writing quirks, or passwords between identities
- • Use New Identity (broom icon, or Ctrl+Shift+U) when switching tasks: it closes tabs, clears cookies and builds fresh circuits
- • New Tor Circuit for this Site (Ctrl+Shift+L) only changes the route for the current site
- • Close Tor Browser completely when you're done
2Handle Downloads Safely
- • Documents (PDF, DOCX, ODT) can load remote resources when opened in another app, revealing your real IP. Open them offline, or inside Tails or a disconnected VM
- • Never torrent over Tor: torrent clients leak your real IP and overload the network
- • Strip metadata from files you upload (Tails includes Metadata Cleaner)
- • Treat executables from onion sites as hostile
3Don't Stand Out (Fingerprinting)
- • Don't install extensions or change about:config: every change makes you more unique
- • Keep letterboxing on (the gray margins) and avoid maximizing to unusual window sizes
- • Don't install extra fonts or themes
- • Let Tor Browser update itself promptly: old versions are easy to spot and may have known exploits
4Timing & Physical Security
Timing Correlation
- • Don't post anonymously at the same moments you're active under your real name
- • Avoid predictable daily patterns for sensitive activity
- • An adversary watching both ends of a connection can correlate traffic: Tor can't fully prevent this
Physical Security
- • Tor doesn't protect a compromised computer: malware sees everything
- • Use full-disk encryption, or Tails for amnesic sessions
- • Watch for cameras and shoulder-surfers in public places
- • Lock your screen whenever you step away
Advanced Tor Usage
1Run Tor as a System Service (Debian/Ubuntu)
Distro packages can lag behind. The Tor Project's own repository at deb.torproject.org ships current releases. Follow the repository setup on support.torproject.org (add the signing key and source line), then:
2torrc Basics & SOCKS Ports
Config file: /etc/tor/torrc
Reload after edits: sudo systemctl reload tor
Which port?
- • 9050: system tor service
- • 9150: the tor bundled inside a running Tor Browser
- • Test:
curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ip - • Use
socks5h/--socks5-hostnameso DNS also goes through Tor
Pointing a regular browser at the SOCKS port does NOT make it anonymous: it lacks Tor Browser's fingerprinting defenses.
3Host Your Own Onion Service
Add to torrc:
Reload tor, then read your new address:
sudo cat /var/lib/tor/my_site/hostnameHardening checklist:
- • Bind the web server to 127.0.0.1 only, never a public interface
- • Back up the HiddenServiceDir keys: lose them and you lose the address
- • Remove server version banners and error pages that leak hostnames or IPs
- • Running a public site too? Add an Onion-Location header so Tor users get the ".onion available" button
4Give Back: Run a Bridge or Relay
obfs4 or WebTunnel Bridge
Helps censored users connect. Low risk and fine on a home connection or small VPS. Setup guides are on community.torproject.org/relay/setup/.
Guard/Middle Relay
Adds bandwidth to the network. Best on a VPS with stable uptime. Your IP is listed publicly as a relay, but traffic doesn't exit from it.
Exit Relay
Never run one from home. Abuse complaints and police inquiries go to the operator. Only run exits on a provider that permits them, ideally with legal support from an established exit operator group.
Mobile Tor Solutions
1Tor Browser for Android
Official sources only:
- • Google Play (publisher: The Tor Project)
- • F-Droid, after adding the Guardian Project repository
- • APK directly from torproject.org/download
Setup:
- 1. Open the app and tap Connect
- 2. If blocked, use the settings gear to configure bridges
- 3. Set the security level under Settings > Privacy and security
- 4. Android 5-7 and 32-bit x86 devices: 15.0 is your final major release
2iOS: Onion Browser
- • There is no official Tor Browser for iPhone. The Tor Project endorses Onion Browser (App Store, free, open source)
- • Apple requires WebKit, so Onion Browser can't replicate Tor Browser's anti-fingerprinting. Expect weaker protection than desktop
- • WebRTC, audio and video can leak more on iOS. Keep its security level high
- • For sensitive work, use Tor Browser on desktop or Tails instead
3Route Other Apps: Orbot & Tor VPN
Orbot (Android & iOS)
- 1. Install Orbot from the Guardian Project (Play, F-Droid, App Store)
- 2. Enable VPN mode
- 3. On Android, choose which apps go through Tor (per-app routing)
- 4. Tap Start and wait for the onion to turn on
Tor VPN (Android, Beta)
The Tor Project's own VPN-style app for Android is in public beta. It routes selected apps over Tor. As beta software, expect rough edges: don't depend on it for high-risk use yet.
4Mobile Cautions
- • Routing an app through Orbot hides your IP, but the app can still send your account, device IDs, and location over Tor
- • Only Tor Browser (or Onion Browser on iOS) gives you browser-level anonymity: never use Chrome or Safari over Orbot for anonymous browsing
- • Your phone number, SIM, and carrier remain tied to your identity regardless of Tor
- • Keep the OS updated: an unpatched phone undermines everything above
Security Analysis & Mitigation
The Problem
Exit Node Traffic Exposure
Traffic leaving exit nodes to reach websites is unencrypted. Exit node operators can intercept:
- HTTP website content and forms
- Login credentials to non-HTTPS sites
- Personal information in unencrypted forms
The Solution
End-to-End Encryption
Protect data from exit node to destination:
- HTTPS-Only mode (enabled by default)
- Use .onion hidden services when available
- Never enter personal credentials
What This Means
Practical Impact
Exit node vulnerability requires behavioral changes:
- Browse anonymously, research only
- Separate identity compartmentalization
- SSL/TLS provides adequate protection
Traffic Analysis Attacks
The Problem: Advanced adversaries can correlate timing and volume of traffic entering and leaving the Tor network to identify users, especially if they control multiple relays or monitor internet infrastructure.
Mitigation Strategies:
- Use public WiFi: Don't use your home connection for sensitive activities
- Vary your timing: Don't browse at predictable times
- Use bridges: Obscure your Tor entry point from ISP monitoring
Slower Browsing Speed
Why It's Slow: Your traffic bounces through 3 random relays worldwide, adding latency. Each hop adds encryption/decryption overhead. Relay bandwidth varies greatly.
Speed Optimization:
- Lighter pages: Safer or Safest levels block heavy scripts and media, which also speeds things up
- New circuit: Ctrl+Shift+L to get new relays if current path is slow
- Be patient: Accept slower speeds as the price of anonymity
Operational Security is Critical
Human Error is the Weakness: Tor can't protect you from poor operational security. One mistake linking your anonymous and real identities can destroy all anonymity.
Essential OPSEC Rules:
- Never login to personal accounts: No Google, Facebook, email, banking
- Don't download files: Especially torrents, PDFs, or executables
- Keep browser default: Don't install plugins or change settings
- Separate identities completely: Different computers, networks, behaviors