Tor App: Your Gateway to the Dark Web

What the Tor App Actually Does (and Doesn't Do)

Tor is a routing network, not a single piece of software. When you open Tor Browser or another app that uses Tor, your traffic passes through three random servers—called relays—in the Tor network[5]. Each relay knows only the relay before it and the relay after it, so no single server sees both your real IP address and the website you visit[6]. The last relay, the exit node, sends your request onto the public Internet.

What Tor hides:
Your Internet service provider cannot see which sites you visit or modify the data you send into the Tor network, because each of the three relays adds a separate layer of encryption[7]. The destination website sees the exit node's IP address, not yours.

What Tor does not hide:
After your traffic leaves the exit node, it travels unencrypted unless the website itself uses HTTPS. That means the exit-node operator can read any unencrypted data you send. Tor does not provide end-to-end encryption; it only anonymises the route.

Official vs third-party 'Tor apps'

The Tor Project maintains Tor Browser for desktop and Android[2], and recommends Onion Browser for iOS[3]. If you search for 'Tor Browser' on Google Play or the App Store, you will see dozens of apps—many for-profit—that bundle unvetted VPNs or ads and are not endorsed by the Tor Project[4]. The official Tor Browser is always free, published by a US 501(c)(3) nonprofit[8], and never includes a separate VPN[9].

To avoid fake apps, download only from the official app stores or visit the Tor Project's download page first and follow the link for your platform[4]. For a full installation walkthrough, see How to Install Tor Browser: A Step-by-Step Guide.

Which Tor App Is Real: Official Releases vs. Impostors

The Tor Project publishes Tor Browser for Windows, macOS, Linux, and Android, but there is no official iOS version[3]. Apple requires all iOS browsers to use the WebKit framework, which prevents the Tor Project from building a browser with the same privacy protections as the desktop and Android editions[10]. For iOS, the Tor Project recommends Onion Browser by Mike Tigas[3]—an independent app that routes traffic through Tor but cannot match the full feature set of Tor Browser on other platforms.

When you search 'Tor Browser' on Google Play or the App Store, you will see dozens of listings that include 'Tor' in the name. Most are for-profit apps that may add unvetted VPNs, display ads, or request unnecessary permissions[4]. The official Tor Browser for Android is published by 'The Tor Project', operates as a US 501(c)(3) nonprofit, and will always be free[8]. It is available on Google Play, F-Droid, the Tor Project website, and GetTor[2].

Checklist: verifying an app before you install

Before you tap 'Install', check these four details:

1. Publisher name – On Google Play, look for 'The Tor Project'. On the App Store, Onion Browser lists 'Mike Tigas'.

2. Download count – The official Tor Browser for Android shows millions of installs; impostor apps often have fewer than 100,000.

3. Permissions – Tor Browser for Android requires Internet and storage access. If an app asks for contacts, SMS, or phone permissions, it is not the official release.

4. Version and update date – The Tor Project updates Tor Browser every few weeks. An app last updated years ago is either abandoned or fake.

If you are unsure, visit the Tor Project's official download page first and follow the link for your operating system[4]. That way, you land on the correct store listing without searching. The Tor Project advises installing only from app stores if you do not know your device architecture[2], because sideloading the wrong APK will fail or behave unpredictably.

No legitimate Tor app bundles a separate VPN or charges a subscription. The official Tor Browser is free, open-source, and never includes trackers[8][9].

Installing the Tor App on Android, iPhone, and Desktop

Each platform has one recommended path. On Android, download Tor Browser from Google Play, F-Droid, or torproject.org; on iPhone, install Onion Browser from the App Store; on desktop, download Tor Browser from torproject.org and verify the file before you run it.

Android: Google Play or direct APK

Tor Browser for Android requires Android 8.0 or newer and supports Aarch64, Arm, and x86_64 architectures[2]. The simplest route is Google Play: search for 'Tor Browser' and confirm the publisher is 'The Tor Project', then tap Install. If Google Play is unavailable, download the APK directly from torproject.org or F-Droid[2]. The Tor Project advises using app stores if you are unsure of your device architecture, because installing the wrong APK will fail silently or crash[2].

After installation, open the app and tap 'Connect'. The first connection takes fifteen to thirty seconds while the app builds a circuit through three relays[5]. Once connected, you can visit .onion sites or regular websites; both routes pass through the Tor network.

iPhone: Onion Browser only

There is no official Tor Browser for iOS[3]. Apple requires all iOS browsers to use the WebKit framework, which prevents Onion Browser from offering the same fingerprinting protections as Tor Browser on desktop or Android[10]. Open the App Store, search for 'Onion Browser', and confirm the developer is Mike Tigas. Tap Get, then open the app and tap 'Connect to Tor'.

Onion Browser routes your traffic through the Tor network, but WebKit exposes more browser metadata than Firefox does on other platforms[10]. If you need stronger privacy, use Tor Browser on a desktop or Android device instead.

Desktop: download and verify

Visit torproject.org/download, choose your operating system, and download the installer. Before you run it, verify the file's GPG signature or SHA-256 checksum. Verification confirms that the file was signed by the Tor Project and has not been tampered with during download. The Tor Project publishes both the signature file and the checksum on the download page.

Why verification matters:
An attacker who controls your network—or compromises a mirror server—can replace the installer with a modified version that logs your activity or installs malware. Checking the signature ensures the file matches the Tor Project's release. If you skip this step, you cannot be certain the software is genuine.

On Windows, use Gpg4win to import the Tor Project's public key and verify the .exe signature. On macOS and Linux, use the built-in gpg and shasum commands. The Tor Project's support pages include line-by-line instructions for each platform.

Once verified, run the installer and follow the prompts. Tor Browser installs as a standalone application and does not modify your system browser. When you open it for the first time, click 'Connect' to build a circuit through three relays[5]. The connection takes ten to twenty seconds, then you can browse .onion sites or the public web through Tor. For a detailed walkthrough, see How to Install Tor Browser: A Step-by-Step Guide.

Mobile fingerprinting trade-offs

Desktop Tor Browser includes advanced protections against fingerprinting: it blocks canvas data, resizes the window to common dimensions, and disables WebGL by default. Tor Browser for Android inherits most of these protections because it is based on Mozilla Firefox for Android[2], but Onion Browser on iOS cannot implement them fully due to Apple's WebKit requirement[10]. If a website collects enough browser metadata—screen size, installed fonts, timezone—it may link your sessions even when your IP address changes. Desktop Tor Browser offers the strongest defence against this; mobile apps reduce but do not eliminate the risk.

Connecting to the Tor Network: Bridges, Censorship, and First Launch

When you open Tor Browser for the first time, you see two options: 'Connect' and 'Configure'. Most users should tap or click 'Connect' and wait while the app builds a circuit through three relays[5]. The first connection takes fifteen to thirty seconds because the app must find three available relays, negotiate encryption with each one, and test the circuit before it routes your traffic[7]. A slow first launch is normal.

If your Internet service provider blocks Tor—or if you live in a country that censors the Tor network—the 'Connect' button will time out and display an error. In that case, you need a bridge.

What a bridge does

A bridge is a Tor relay that is not listed in the public directory[6]. Because the relay's IP address is not published, your ISP cannot see that you are connecting to Tor and cannot block the connection by IP. The bridge forwards your traffic into the Tor network, where it passes through two more relays before reaching the exit node[5]. From the outside, your connection looks like ordinary encrypted traffic to an unlisted server.

Bridges are useful in two scenarios: your ISP blocks known Tor relay addresses, or your country operates national-level censorship that identifies and blocks Tor connections. If neither applies, you do not need a bridge.

Requesting a bridge

You can request a bridge address in three ways:

1. Within the app – Tap 'Configure' on the first-run screen, then 'Request a Bridge from torproject.org'. The app will fetch a bridge address and add it to your settings.

2. From the Tor Project website – Visit bridges.torproject.org, complete the CAPTCHA, and copy one of the bridge lines into Tor Browser's connection settings.

3. By email – Send an email to [email protected] from a Gmail, Riseup, or ProtonMail address with 'get bridges' in the body. The Tor Project will reply with three bridge addresses.

Once you have a bridge line, open Tor Browser's settings, navigate to 'Tor', and paste the line into the 'Provide a bridge' field. Tap 'Connect' again. The connection may take thirty to sixty seconds because the bridge must forward your request through the public Tor network[5].

Troubleshooting a failed connection

If 'Connect' times out or displays 'Failed to establish a connection to the Tor network', follow this sequence:

1. Check your Internet connection – Open a regular browser and confirm you can reach any website. If your Internet is down, Tor cannot connect.

2. Try a bridge – Even if you do not live in a censored country, some ISPs throttle or block Tor by accident. Request a bridge and add it to your settings.

3. Check your system clock – Tor's encryption relies on accurate time. If your device clock is off by more than a few minutes, the handshake with relays will fail. Set your clock to automatic.

4. Disable your VPN – The Tor Project advises against using a separate VPN with Tor[9]. If you run both at once, the VPN may block Tor's connection attempts or route traffic in a way that breaks the circuit.

If none of these steps work, visit the Tor Project's support forum and describe the error message you see. Include your operating system, the version of Tor Browser, and whether you are using a bridge. Do not post your real IP address or bridge line in a public forum.

A successful connection displays 'Connected to the Tor network' and opens the default start page with a DuckDuckGo search box. You can now visit .onion sites or browse the public web through Tor. For guidance on finding .onion addresses safely, see How to Find the Dark Web: A Step-by-Step Guide.

Browsing the Dark Web Safely: .onion Sites and Search

A .onion address is a string of random letters and numbers followed by '.onion'—for example, 'thehiddenwiki.onion' or '3g2upl4pq6kufc4m.onion'. These addresses exist only on the Tor network and cannot be reached through Chrome, Safari, or any browser that does not route traffic through Tor. Regular search engines do not index .onion sites, so you will not find them on Google or Bing.

When you connect to a .onion site, your traffic passes through three relays inside the Tor network[5][6], and the site itself runs as a hidden service that never exposes its real IP address. This design protects both you and the site operator, but it also means you cannot verify a .onion address by visiting the site's public homepage or checking a domain registrar. If someone gives you a fake .onion link, you will land on a phishing page with no warning from your browser.

Starting points: DuckDuckGo and directories

DuckDuckGo operates a .onion version of its search engine at 'duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion'. You can type this address into Tor Browser's address bar, or visit duckduckgo.com through Tor and click the link labelled 'Also available as a Tor hidden service'. The .onion version indexes a mix of clearnet pages and a small number of .onion sites, but it will not return results for most hidden services because site operators must submit their addresses manually.

A handful of directories list .onion links by category. These directories are themselves .onion sites, and they curate links to forums, marketplaces, file-sharing services, and news outlets. Two well-known examples are The Hidden Wiki and Ahmia. Neither is comprehensive, and both include dead links because .onion sites move or shut down without notice. Treat directory listings as a starting point, not a guarantee that a link is safe or still active.

The phishing risk: random links from forums

Clicking a .onion link you found on Reddit, a Telegram group, or a public forum is the most common way users land on phishing pages. An attacker can register a .onion address that looks similar to a legitimate site—changing one letter or swapping a zero for the letter 'o'—and post the fake link in a thread where people ask for the real address. If you visit the fake site and enter a password or upload a file, the attacker captures everything.

Conditional scenario:
Suppose you want to visit a marketplace that a friend mentioned. Your friend sends you a .onion address in a private message. Before you visit, ask your friend where they found the address. If they copied it from a forum post or a screenshot, search for the marketplace's name on Ahmia or DuckDuckGo's .onion search and compare the addresses. If the two addresses match, you have confirmation. If they differ by even one character, assume the forum link is fake and use the address from the directory instead. For a broader overview of navigating hidden sites, see How to Find the Dark Web: A Step-by-Step Guide.

Verifying addresses from trusted sources

A 'trusted source' means the site's official clearnet page, a PGP-signed message from the operator, or a directory that has been online for years and is referenced by multiple independent communities. If a marketplace or forum publishes its .onion address on a clearnet site, visit that clearnet site through Tor and copy the address directly. Do not rely on a third party's pastebin, a screenshot, or a link shortened by a URL service.

Some sites publish a PGP-signed text file that lists their current .onion addresses. If you have the site operator's public key, you can verify the signature and confirm the list is genuine. This method requires familiarity with GPG, but it is the strongest proof that an address has not been tampered with.

When you visit a .onion site for the first time, Tor Browser will not display a padlock icon or a certificate authority name, because .onion addresses use self-authenticated encryption built into the Tor protocol[7]. The absence of a padlock does not mean the connection is insecure; it means the site's identity is verified by the .onion address itself rather than by a third-party certificate. If the address in your browser bar matches the address you copied from a trusted source, the connection is genuine.

Security Settings That Matter More Than the App Itself

Tor Browser includes three security levels that control which browser features can run on the sites you visit. You find them by clicking the shield icon in the address bar, then 'Settings' → 'Privacy & Security' → 'Security Level'. The three levels are Standard, Safer, and Safest. Each one disables progressively more features, and each trades convenience for protection against attacks that exploit browser code.

Standard is the default. JavaScript runs on all sites, web fonts load, and video and audio play inline. This level offers the baseline protections that Tor Browser provides—your traffic passes through three relays[5], each connection is encrypted[7], and no relay knows the complete path[6]—but it does not block scripts or media that could fingerprint your browser or exploit a vulnerability in Firefox.

Safer disables JavaScript on sites that do not use HTTPS, blocks custom fonts, and stops video and audio from playing automatically. JavaScript on HTTPS sites still runs, which means interactive pages work but you lose some protection against fingerprinting. If a site serves malicious code over HTTPS, Safer will not block it.

Safest disables JavaScript on all sites, blocks all custom fonts, disables video and audio, and stops some images from loading. Many .onion sites rely on JavaScript for navigation, login forms, or search boxes, so Safest breaks them completely. You will see a page of unstyled text, or a blank screen, or an error message that says 'JavaScript is required'. Safest is the only level that eliminates most browser-based attacks, but you cannot use it for everyday browsing.

When to use Safest

Use Safest when you visit a site you do not trust and you only need to read static text. If you are checking a .onion directory, reading a news article, or verifying an address, Safest prevents the site from running code that could exploit your browser or collect fingerprinting data. Switch back to Standard or Safer when you need to log in, submit a form, or watch a video.

Do not leave Safest enabled permanently unless you accept that most sites will not work. The setting applies to every tab in your current session, so if you enable Safest in one tab, every other tab switches to Safest as well.

What not to install or do

The Tor Project's ground rules state that you should not install any extra plugins or add-ons[9]. Browser extensions can read every page you visit, inject their own JavaScript, and send data to third-party servers. Even a privacy-focused extension can break Tor's protections by leaking your timezone, language preferences, or the list of other extensions you have installed. Tor Browser blocks most extension APIs by default, but installing one manually overrides that protection.

Do not log into personal accounts—email, social media, online banking—while using Tor. If you log into Gmail through Tor, Google links your Tor session to your real identity, and any .onion site you visit in the same session can be correlated with your account through browser fingerprinting or accidental data leaks. Open personal accounts in a separate browser on the clearnet, not in Tor Browser.

Do not download files through Tor unless you open them in a sandboxed environment or on a device that is not connected to the Internet. A PDF, Word document, or executable can contain scripts that connect to the Internet outside Tor and reveal your real IP address. Tor Browser warns you when you start a download, but it cannot stop a file from running after you open it.

Tor Browser clears all cookies, site data, and browsing history when you close the application. This happens automatically; you do not need to configure it. If you want to preserve a login session or a site preference, you must leave Tor Browser open. Closing and reopening the app gives you a fresh identity with no link to your previous session.

Common Mistakes That Undo Tor's Protection

Installing Tor from the wrong place is the fastest way to lose anonymity before you even open the browser. If you search for 'Tor Browser' in the Google Play Store or iPhone App Store, you will see dozens of apps that may not be endorsed by the Tor Project and may come bundled with unvetted VPNs[4]. These apps can log your traffic, inject ads, or route your connection through servers controlled by the app developer instead of the Tor network. On Android, the only official app is Tor Browser for Android[8]; on iOS, the Tor Project recommends Onion Browser[3]. Download from the Tor Project's website first, then follow the link to your platform's app store[4]. Installing a fake app exposes every site you visit and every .onion address you type.

Logging into Google, Facebook, or your personal email over Tor links your Tor session to your real identity. When you sign in, the service records your account name, the time of login, and browser characteristics that can be correlated with other sessions. If you visit a .onion site in the same session, the service can infer that your account is associated with that .onion address, even though the site itself never learns your identity. Open personal accounts in a separate browser outside Tor, or use a dedicated anonymous account that you never access from your home IP address.

Opening a downloaded PDF or Word document while Tor Browser is still running can reveal your real IP address. Documents often contain embedded scripts, remote images, or macros that connect to the Internet to fetch fonts, check for updates, or phone home to the document creator. These connections bypass Tor and go straight out through your normal Internet connection, exposing your IP to anyone monitoring the remote server. Tor Browser warns you when you start a download, but it cannot stop a file from running after you save it. If you must open a document, close Tor Browser first, disconnect from the Internet, and open the file in a sandboxed viewer or on a device that has no network access.

Resizing the Tor Browser window to full screen or maximising it makes your browser fingerprint more unique. Tor Browser sets a default window size—usually 1,000 × 1,000 pixels or 1,200 × 900 pixels—so that every user presents the same screen dimensions to websites[5][6]. If you resize the window, a site can measure the new dimensions with JavaScript and use that measurement to distinguish you from other Tor users. The difference might seem small, but when combined with your timezone, language, and the order in which you visit sites, it can be enough to track you across sessions. Leave the window at its default size, even if it looks awkward on a large monitor.

Enabling location services or granting Tor Browser permission to access your camera, microphone, or Bluetooth will leak identifying data. Tor Browser blocks these requests by default, but if you click 'Allow' on a permission prompt, the site can read your GPS coordinates, scan for nearby Wi-Fi networks, or capture audio that includes background noise unique to your location. These data points bypass Tor's network-level protections entirely. Deny all permission requests unless you are testing the browser in a controlled environment and you understand the consequences.

Using a VPN with Tor creates a false sense of security and can make tracking easier if the VPN provider logs your connection. The Tor Project's ground rules state that you should not use a separate VPN with Tor[9]. A VPN before Tor hides your real IP from the Tor entry relay, but it also funnels all your Tor traffic through a single company that can correlate the timing and volume of your connections. A VPN after Tor (a 'Tor over VPN' setup) exposes your .onion visits to the VPN provider and adds no meaningful protection. If your threat model requires hiding Tor use from your Internet provider, use a Tor bridge instead; if you need to hide your destination from Tor exit relays, visit .onion sites that never leave the Tor network.

Pasting personal information—your real name, phone number, home address, or a username you use elsewhere—into a .onion form links your anonymous session to your real identity. Even if the site operator does not log your data, a data breach, a server seizure, or a mistake in the site's code can expose the information later. If you must register an account on a .onion site, create a new username and password that you have never used before, and generate them with a password manager so they contain no patterns tied to your other accounts. Do not reuse an email address, a payment method, or any identifier that appears in public records or on social media.

Is Tor Safe on Phones? What Changes on Mobile

Tor Browser for Android routes your traffic through the same three-relay network as the desktop version[5][7][6], but it protects only the traffic inside the browser itself. If you open a different app—email, messaging, a news reader—that app connects to the Internet through your normal mobile connection, not through Tor. Your phone's operating system can still read your device identifier, your SIM card number, your GPS coordinates, and the list of apps you have installed, and it can send that data to Google, Apple, or your mobile carrier without Tor Browser knowing. The browser cannot protect data it never handles.

On Android, Tor Browser for Android is the only official app supported by the Tor Project[8]. It requires Android 8.0 or newer and works on Aarch64, Arm, and x86_64 architectures[2]. You can install it from the Google Play Store, F-Droid, the Tor Project website, or GetTor[2]. The app is always free[8], and it includes the same security levels—Standard, Safer, Safest—as the desktop browser. If you enable Safest, JavaScript stops running on every site you visit in every tab, which breaks most .onion login forms and search boxes.

What Orbot does and when not to use it

Orbot is a separate app from The Guardian Project that routes other Android apps through the Tor network[3]. It acts as a local proxy: you install Orbot, start it, then configure each app to send its traffic through Orbot's proxy address. Some apps support proxy settings natively; others require root access or a third-party tool to redirect their connections. Orbot does not automatically protect every app on your phone, and it does not hide your device identifier or your installed-app list from the operating system.

Use Orbot only if you understand per-app proxying and you have verified that the app you want to route actually respects the proxy setting. If you configure an app incorrectly, it will connect directly to the Internet and leak your real IP address while you assume it is protected. For most users, Tor Browser for Android is the safer choice because it guarantees that browser traffic goes through Tor and nothing else does.

iOS and the limits of Onion Browser

There is no official version of Tor Browser for iOS because Apple's restrictions prevent it[3]. The Tor Project's best available recommendation for iOS is Onion Browser, a third-party app developed by Mike Tigas[3]. Apple requires all browsers on iOS to use the WebKit framework, which prevents Onion Browser from having the same privacy protections as Tor Browser on other platforms[10]. Onion Browser routes your traffic through the Tor network, but it cannot disable WebKit features that leak fingerprinting data, and it cannot block iOS system services that send telemetry to Apple. If your threat model requires the full protections of Tor Browser, use an Android device or a desktop computer instead.

Legal Status and What Tor Does Not Protect You From

Using Tor is legal in most countries. You can download Tor Browser, install it, and visit .onion sites without breaking the law in the United Kingdom, the United States, the European Union, and dozens of other jurisdictions. A few governments restrict or ban Tor outright: China blocks connections to the Tor network through its firewall, Russia has attempted to ban Tor and prosecute users who run relays, Iran blocks Tor and criminalises circumvention tools, and Belarus has made Tor illegal under its Internet restrictions. If you live in one of these countries, using Tor can carry legal risk even if you are not doing anything else illegal. Check your local laws through the Electronic Frontier Foundation's country reports or your government's official guidance before you install the app.

Tor does not make illegal activity legal. If you use Tor Browser to access child exploitation material, buy controlled substances, hire someone to commit a crime, or engage in fraud, you are committing a crime regardless of the technology you use. Law enforcement agencies investigate .onion services and arrest operators and users through operational security failures—reused usernames, payment methods that link to real identities, server misconfigurations that leak IP addresses, and mistakes in how people handle evidence—not by breaking Tor's encryption[7][6]. Courts in multiple countries have convicted individuals for crimes committed over Tor, and using the network is not a defence.

Tor does not protect you from malware, phishing, or human error. If you download a file that contains a virus, open a phishing site that tricks you into entering your password, or type your real name into a form on a .onion site, Tor cannot stop the consequences. The network hides your IP address from the sites you visit[5][6], but it does not scan downloads for malware, it does not verify that a .onion address is legitimate, and it does not prevent you from revealing identifying information. You must still practise basic operational security: verify .onion addresses through multiple sources, do not download files unless you can open them offline, and never enter personal data that links your session to your real identity.

Before you rely on Tor for sensitive activity, read the current legal guidance for your country and understand what the network does and does not protect. For a broader overview of safe practices, see How to Access the Dark Web: A Step-by-Step Guide.

Common Mistakes and Misconceptions

Downloading a third-party 'Tor app' from an app store

If you search for 'Tor Browser' in the Google Play Store or iPhone App Store, you will see dozens of mostly for-profit apps that may not be endorsed by the Tor Project and may come bundled with unvetted VPNs[4]. People install these impostors because they look official, have similar names, or rank higher in search results than the real app. The result is often an app that logs your traffic, injects ads, or fails to route your connection through Tor at all. On Android, install only 'Tor Browser' published by The Tor Project; on iOS, use 'Onion Browser' by Mike Tigas, which the Tor Project lists as its best available recommendation[3][8].

Assuming Tor Browser for iOS exists

Many users search for 'Tor Browser iOS' and assume the app they find is the official version. There is no official version of Tor Browser for iOS because Apple's restrictions prevent it[3]. Apple requires browsers on iOS to use the WebKit framework, which prevents Onion Browser from having the same privacy protections as Tor Browser on other platforms[10]. If you see an app claiming to be 'official Tor Browser for iOS,' it is an impostor. The safest approach on iOS is to accept the limitation and use Onion Browser, or switch to Android or desktop when you need the full protections.

Skipping the desktop checksum or GPG verification

Most guides tell you to download Tor Browser but never mention verifying the file. Without verification, you cannot tell whether the installer was modified in transit or replaced by a malicious mirror. The Tor Project publishes checksums and GPG signatures for every release, and checking them takes a few minutes in a terminal. If you skip this step, you are trusting that the download server was not compromised and that your connection was not intercepted. For desktop users, verification is the only way to confirm that the file you received is the file the Tor Project signed.

Enabling JavaScript on .onion sites without understanding the risk

Tor Browser includes three security levels: Standard, Safer, and Safest. Standard leaves JavaScript enabled on all sites, which makes .onion sites easier to use but also allows them to run code that can fingerprint your browser or exploit vulnerabilities. Many users never change this setting because they do not know it exists. Safest disables JavaScript on every site, which breaks most .onion login forms and search boxes but removes a large class of tracking and exploitation risks. For dark web browsing where you do not need interactive features, Safest is the safer default; for sites you trust and need to use, switch to Safer or Standard only after you understand what you are giving up.

Believing a VPN adds meaningful privacy to Tor

The Tor Project's ground rules state that you should not use a separate VPN with Tor[9]. People add VPNs because they believe layering tools always increases anonymity. In practice, a VPN before Tor funnels all your Tor traffic through a single company that can correlate the timing and volume of your connections, and a VPN after Tor exposes your .onion visits to the VPN provider. Neither setup adds protection against the threats Tor is designed to address. If you need to hide Tor use from your Internet provider, use a Tor bridge; if you need to hide your destination from exit relays, visit .onion sites that never leave the Tor network.

Assuming Tor use is legal everywhere without checking

Using Tor is legal in the UK, the US, the EU, and many other countries, but a few governments restrict or ban it outright. China blocks connections to the Tor network, Russia has attempted to ban Tor and prosecute relay operators, Iran blocks Tor and criminalises circumvention tools, and Belarus has made Tor illegal. People assume that because Tor is legal in their country, it is legal everywhere, or that using Tor for legal purposes cannot carry risk. If you live in or travel to a country with restrictions, using Tor can carry legal risk even if you are not doing anything else illegal. Check your local laws through the Electronic Frontier Foundation's country reports or your government's official guidance before you install the app.

Conclusions

• Install Tor Browser only from official sources: The Tor Project for Android and desktop, Mike Tigas's Onion Browser for iOS. Check the publisher name before you tap 'Install'.

• Verify the desktop installer with checksums or GPG signatures before you run it. This is the only way to confirm the file was not modified in transit.

• Set the security level to Safest for .onion sites you do not need to interact with. JavaScript remains the most common route for fingerprinting and exploitation.

• Skip the VPN. A VPN before or after Tor does not add meaningful privacy and can create a single point of correlation.

• Check your local laws before installing Tor, especially if you live in or travel to a country that restricts it.

Your first practical step is to visit the Tor Project's official download page and install Tor Browser for Android or desktop, then verify the file. For a full walkthrough from installation to your first .onion site, see How to Access the Dark Web: A Step-by-Step Guide.