Onion Browser: What You Need to Know

What Onion Browser Actually Is (and What It Is Not)

Onion Browser is a specific iOS app that connects you to the Tor network, not a general term for any browser that accesses .onion sites. The official app has been in the Apple App Store since 2012 and became free after initially costing £0.79[1][2]. When you open a website in Onion Browser, your request travels through three volunteer-run Tor relays—an entry node, a middle node, and an exit node—with a layer of encryption removed at each step[4][5]. Each relay knows only the previous and next relay in the chain, not the full path[5].

What Onion Browser is not

• Not the same as Tor Browser on desktop or Android. Apple requires all iOS browsers to use WebKit, so Onion Browser cannot use the Firefox Gecko engine that powers Tor Browser elsewhere[3]. This means different fingerprinting characteristics and some compatibility differences.

• Not a VPN. A VPN encrypts all device traffic to a single server you choose; Onion Browser routes only traffic within the app through three randomly selected Tor relays[3][5]. Network requests from other apps on your iPhone continue over your normal connection[3].

• Not a dark web search engine. Onion Browser is a web browser; you still need to know a .onion address or use a search engine inside the browser to find sites.

• Not a guarantee of anonymity. If you log into Facebook or Gmail through Onion Browser using your real account, those services know who you are, and they can see you are connecting via Tor[3]. Your internet provider can also detect that you are using Tor, though not which sites you visit[6].

The generic phrase 'onion browser' sometimes refers to any browser capable of accessing .onion addresses, but capitalised 'Onion Browser' is the name of this particular iOS app.

How Onion Routing Works in Plain Terms

When you open a website in Onion Browser, your request does not travel directly to that site. Instead, it passes through three volunteer-run Tor relays—an entry node, a middle node, and an exit node—in sequence[4][5]. Each relay removes one layer of encryption before forwarding the request to the next relay, which is why the system is called 'onion routing'[5]. The entry node sees your real IP address but not your destination; the middle node sees neither; the exit node sees the destination website but not your IP[5].

What each node can and cannot see

• Entry node (guard relay). Sees your IP address and knows you are using Tor, but cannot see which website you are visiting or the content of your request. Your internet provider can also tell you are connecting to Tor, though not what you are doing on it[6].

• Middle node. Sees only encrypted data passing between the entry and exit nodes. It knows neither your IP address nor your destination.

• Exit node. Sees the website you are visiting and any unencrypted content (such as plain HTTP requests), but it sees the middle node's address as the source, not your real IP[5].

A conditional example

Suppose you use Onion Browser to open example.com over HTTPS. The website's server logs show a connection from the exit node's IP address—perhaps in Germany—not your actual IP in Bristol. The entry node in France knows your Bristol IP connected to Tor but has no idea you visited example.com. The middle node in Sweden knows only that encrypted data moved between two other relays. No single relay or observer sees both your identity and your destination[5].

This three-hop design means that even if one relay is compromised or logging traffic, an attacker would need to control at least two of the three relays in your circuit to link you to a specific website—a scenario the Tor network's thousands of volunteer relays make difficult[4][5].

What Onion Browser Protects — and What It Does Not

Onion Browser hides your IP address from the websites you visit and hides your destination from your internet provider, but it cannot protect you from every privacy risk[4][5]. The exit node—the final relay before your request reaches a website—can see any unencrypted traffic, including plain HTTP requests and unencrypted form data[5]. If you log into your personal Facebook or Google account through Onion Browser, those services know exactly who you are, and they can tell you are connecting via Tor[3]. The app routes only traffic within Onion Browser itself; other apps on your iPhone continue to use your normal connection[3].

What Onion Browser does protect

• Your IP address from destination websites. The site you visit sees the exit node's IP address, not yours[5].

• Your browsing destination from your ISP. Your internet provider knows you are using Tor but cannot see which websites you open[6].

• Traffic between relays. Each relay removes one layer of encryption, so the entry node cannot read your request and the exit node cannot see your IP[4][5].

What Onion Browser does not protect

• Unencrypted traffic at the exit node. If you visit a site over HTTP (not HTTPS), the exit node can read the full content of your request, including passwords or messages[5].

• Your identity when you log in. Signing into any account that knows your real name links that session to you, regardless of Tor[3].

• Traffic outside the app. Network requests from Mail, WhatsApp, or other iOS apps bypass Tor entirely[3].

• Some embedded content. iOS may route audio or video embeds over your normal connection, not through Tor[3].

What to avoid

• Logging into personal accounts. Do not sign into Facebook, Gmail, or any service tied to your real identity unless you intend the service to know you are using Tor[3].

• Sending sensitive forms over HTTP. Always check for HTTPS (the padlock icon) before submitting passwords, payment details, or private messages.

• Enabling scripts unnecessarily. JavaScript can leak information about your device or bypass Tor protections; Onion Browser's security settings let you block scripts by default.

• Downloading files and opening them outside the app. A PDF or document opened in another app may phone home over your normal connection, revealing your IP[3].

• Mixing Tor and non-Tor activity in the same session. If you browse your bank over your normal connection and then switch to Onion Browser, timing analysis could link the two sessions.

Onion Browser gives you strong protection against network surveillance, but it cannot fix risky behaviour. You remain responsible for what you type, which accounts you use, and which links you click.

Is Onion Browsing Safe and Legal?

Using Onion Browser is legal in the United Kingdom, the United States, and most other jurisdictions[6]. There is nothing illegal about connecting to the Tor network itself—government agencies depend on Tor for secure communications, and the CIA even hosts a website within the network[6]. In Germany, browsing the dark net is explicitly legal, though you become liable to prosecution the moment you consume, download, or purchase illegal content[7]. The tool does not grant immunity: if an activity is illegal without Tor, it remains illegal when you use Onion Browser.

Safety depends on three factors

Official app versus fake clones. The legitimate Onion Browser has been in the Apple App Store since 2012 and is published by a verified developer[1][2]. Fake apps occasionally appear in app stores, designed to steal credentials or inject malware. Always check the developer name and reviews before installing; the official app is free and open-source[1].

Malicious exit nodes. The exit node—the final relay before your request reaches a website—can see any unencrypted traffic[5]. Documented cases have shown attackers running exit nodes to harvest passwords sent over plain HTTP or to inject malicious code into unencrypted pages. Always verify that a site uses HTTPS (the padlock icon) before entering sensitive information. If a site offers only HTTP, assume the exit node can read everything you type.

Phishing on .onion sites. .onion addresses are long random strings (for example, thehiddenwiki...onion), making them easy to mistype or fake. Phishing sites copy the layout of legitimate services and change one character in the address. Bookmark trusted .onion links after verifying them from multiple independent sources, and double-check every character before logging in or sending payment.

What increases your risk

• Installing Onion Browser from unofficial sources or sideloading modified versions.

• Visiting HTTP sites, where the exit node can read and alter your traffic.

• Clicking links in forums or messages without verifying the full .onion address.

• Disabling Onion Browser's security settings or allowing all scripts by default.

Onion Browser protects your network traffic, but it cannot protect you from scams, malware hosted on .onion sites, or your own mistakes. The dark web contains both legal resources and illegal marketplaces; legality depends entirely on what you access and what you do there, not on the browser you use.

Onion Browser vs Tor Browser vs Brave Private Window

When you search for private browsing tools, you will encounter three names: Onion Browser, Tor Browser, and Brave's private window. They offer different levels of protection, and choosing the wrong one can leave you exposed.

Platform availability

Onion Browser runs only on iOS and has been in the Apple App Store since 2012[1][2]. Apple requires all iOS browsers to use WebKit, so Onion Browser cannot use the Firefox Gecko engine that powers Tor Browser on other platforms[3]. Tor Browser is available for Windows, macOS, Linux, and Android, but not for iOS. Brave works on all major desktop and mobile platforms, including iOS.

If you use an iPhone or iPad, Onion Browser is the only option that routes traffic through the Tor network[1][3]. Desktop users should install Tor Browser directly; mobile Android users can install Tor Browser or use Orbot with another browser.

Default privacy settings and script blocking

Tor Browser ships with the strongest defaults: it blocks third-party trackers, isolates each website in a separate circuit, and disables JavaScript on the safest security level. Onion Browser offers similar controls—you can block scripts, disable media auto-play, and clear cookies on exit—but the WebKit engine means different fingerprinting characteristics than desktop Tor Browser[3]. Brave's private window blocks ads and trackers but does not route traffic through Tor by default; Brave's optional 'Private Window with Tor' feature routes only requests within that window through Tor, and it still uses Chromium's engine, which has a larger fingerprint than Tor Browser.

Fingerprinting protection

Tor Browser resists fingerprinting by making every user look identical: same window size, same fonts, same plugin list. Onion Browser cannot fully replicate this because iOS controls WebKit behaviour, and some network traffic—such as audio or video embeds—may bypass Tor entirely[3]. Brave reduces fingerprinting with techniques like canvas blocking and font randomisation, but it does not aim for uniformity across users, so websites can still distinguish Brave users from one another more easily than Tor Browser users.

Ease of use and speed

Brave's private window feels like a normal browser with slightly slower page loads. Onion Browser and Tor Browser are noticeably slower because your traffic is encrypted and relayed through three volunteer-run servers[4][1]. Onion Browser's interface is straightforward—tap the security shield to adjust settings—but some sites break when scripts are blocked, requiring you to whitelist domains manually. Tor Browser handles script blocking more gracefully because it has been tuned for years on the desktop Gecko engine.

Clear recommendation

• If you use iOS and need Tor, install Onion Browser from the Apple App Store[1]. It is the only legitimate Tor-powered browser for iPhone and iPad.

• If you use a desktop or Android device, install Tor Browser directly. It offers stronger fingerprinting protection and better compatibility than Onion Browser's WebKit constraints allow[3].

• If you want convenience and light tracking protection without Tor, use Brave's private window. It is faster and easier than Tor, but it does not hide your IP address from websites or your destination from your internet provider[4][6].

Brave's 'Private Window with Tor' is a compromise: it routes traffic through Tor but still uses Chromium, so you gain IP masking at the cost of a less uniform fingerprint. For serious anonymity needs, Tor Browser on desktop or Onion Browser on iOS remains the better choice.

Common Mistakes That Undo Your Anonymity

Onion Browser routes your traffic through the Tor network, but a single mistake can link your session to your real identity. The most common errors are behavioural—what you type, which accounts you open, and how you configure the app—rather than technical flaws in Tor itself.

Logging into personal accounts

If you sign into Facebook, Gmail, or any service tied to your real name, that service knows exactly who you are, regardless of Tor[3]. The website sees your login credentials and can record that you connected via a Tor exit node. Your ISP still knows you are using Tor, and the service now knows both your identity and that you chose to hide your IP address[6][3].

What to do instead: Create separate accounts with anonymous email addresses if you need to use a service through Onion Browser. Never log into your personal bank, social media, or email unless you intend the service to know you are using Tor.

Maximising the window or changing font sizes

Tor Browser on desktop resists fingerprinting by making every user's window the same size and displaying the same fonts. Onion Browser cannot enforce identical window dimensions because iOS controls WebKit behaviour[3], but resizing the window or increasing font size in iOS accessibility settings makes your browser more distinctive. Websites can measure your viewport and font metrics to build a fingerprint that distinguishes you from other Onion Browser users.

What to do instead: Use the default window size and avoid changing system font sizes while browsing through Onion Browser.

Opening downloaded files while connected

When you download a PDF, image, or document and open it in another iOS app, that app uses your normal internet connection, not Tor[3]. Many file formats—especially PDFs and Office documents—can contain embedded links or scripts that phone home to a remote server, revealing your real IP address the moment you open the file.

What to do instead: Disconnect from the internet or disable mobile data before opening any file downloaded through Onion Browser. Better still, transfer the file to a separate device that has never been linked to your identity.

Mixing personal and anonymous browsing in the same session

If you check your bank over your normal connection and then switch to Onion Browser five minutes later, an observer who monitors both your ISP traffic and the timing of requests at the destination can correlate the two sessions. Timing analysis does not require access to the content of your traffic—only the pattern of when packets arrive and leave.

What to do instead: Close all other apps and wait at least ten minutes between normal browsing and Onion Browser sessions. Ideally, use Onion Browser on a separate device or after rebooting your phone.

Enabling browser extensions or third-party keyboards

iOS does not allow traditional browser extensions in the same way desktop browsers do, but third-party keyboards, password managers, and clipboard tools can log what you type or send data over your normal connection[3]. Any app with keyboard access can record your .onion addresses, passwords, or messages before Onion Browser encrypts them.

What to do instead: Switch to the default iOS keyboard before opening Onion Browser. Disable clipboard access for other apps in iOS privacy settings, and do not paste sensitive text that you copied in another app.

Allowing scripts and media to load automatically

JavaScript can fingerprint your device by measuring screen size, installed fonts, battery level, and dozens of other properties. Onion Browser lets you block scripts by default, but many users enable them for convenience. Audio and video embeds may bypass Tor entirely on iOS, routing over your normal connection and leaking your IP address[3].

What to do instead: Set Onion Browser's security level to block scripts by default, and whitelist only the specific domains you trust. Avoid sites with embedded media unless you have verified that the content loads over Tor.

Tor protects your network traffic, but it cannot protect you from what you type or which accounts you open. Every login, every file you download, and every script you allow is a decision that either preserves or breaks your anonymity.

How to Verify You Are Using the Real Onion Browser

Malicious apps with similar names appear in unofficial stores and sideloading repositories, promising Tor anonymity while logging your traffic or injecting ads. Before you trust any browser with sensitive browsing, you need to confirm you have installed the legitimate version.

Official distribution channels

On iOS, the only legitimate source is the Apple App Store[1]. Search for 'Onion Browser' and check that the developer name is Mike Tigas. The app has been available since 2012 and was previously priced at £0.79 before becoming free[2]. The App Store listing shows the developer's name, user reviews dating back years, and a privacy label that confirms the app does not collect data linked to your identity.

On desktop or Android, Onion Browser does not exist. If you find a Windows or Android app called 'Onion Browser', it is not the official iOS app and may be a scam. Desktop and Android users should install Tor Browser directly from the Tor Project's website at torproject.org, not from third-party download portals.

What to check before installing

1. Developer name: Confirm 'Mike Tigas' on the App Store listing[1].

2. App icon and description: The official app describes itself as 'the original free and open-source Tor-powered web browser for iOS'[1].

3. Review history: Legitimate apps have reviews spanning multiple years. A newly published app with identical branding is a clone.

4. Price: Onion Browser is free[2]. Any app charging a subscription or one-time fee under the same name is not the official version.

GitHub repository and source code

Onion Browser is open source, and you can inspect the code at github.com/OnionBrowser/OnionBrowser. The repository shows commit history, issue discussions, and the developer's identity. If you have technical skills, you can compare the App Store version's behaviour against the published source code, though Apple's build process means you cannot verify a byte-for-byte match without access to the signing keys.

For desktop Tor Browser builds, the Tor Project publishes GPG signatures and SHA-256 checksums on its download page. You can verify the checksum of your downloaded file against the published hash to confirm no one has tampered with the installer. iOS apps distributed through the App Store do not expose checksums to end users, so you rely on Apple's code signing and the developer's identity.

Red flags that indicate a fake app

• Third-party download sites: Any website offering an Onion Browser APK, IPA file, or Windows installer is distributing either an unofficial port or malware.

• Apps with similar names: 'Onion VPN', 'Onion Tor Browser Pro', or 'Dark Web Browser' are separate apps, not the official Onion Browser[1].

• Requests for payment or subscriptions: The official app is free[2].

• Permissions that exceed browsing needs: Onion Browser does not need access to your contacts, camera, or microphone for normal operation.

If you installed Onion Browser from anywhere other than the Apple App Store, delete it immediately and download the official version[1]. Sideloading modified versions or installing apps from unofficial repositories exposes you to traffic interception, keylogging, and credential theft, defeating the purpose of using Tor in the first place.

What to Expect When You First Open an .onion Site

Your first visit to a .onion address will feel slower and less reliable than normal web browsing. Pages take longer to load, you will see CAPTCHA challenges on many sites, and some addresses simply time out without explanation. These delays are not bugs—they are consequences of how Tor routes your traffic through three volunteer-run relays and how .onion sites operate without traditional DNS or hosting infrastructure[4][5].

Slow page loads and frequent timeouts

A typical .onion site takes five to fifteen seconds to load the first time you visit, and complex pages with images or scripts can take thirty seconds or more[1]. Each request travels through three Tor relays, and each relay adds latency[4][5]. If any relay in your circuit is slow or overloaded, the entire page load stalls.

Conditional scenario: You paste a known .onion address into Onion Browser and press Go. The browser shows a loading spinner for twenty seconds, then displays 'Unable to connect'. This usually means one of three things:

1. The site is offline. .onion services run on volunteers' machines or rented servers, and many go down without notice. Directories often list addresses that stopped working months ago.

2. Your circuit is broken. One of the three relays in your current path has dropped the connection. Tap 'New Identity' in Onion Browser's settings to build a fresh circuit and try again.

3. The address is a v2 onion. Older sixteen-character .onion addresses (v2) stopped working across the Tor network in October 2021. Only fifty-six-character v3 addresses remain functional. If the address you copied is short, it is obsolete and will never load.

CAPTCHAs and access barriers

Many clearnet sites—Google, Cloudflare-protected pages, and large forums—treat Tor exit nodes as suspicious traffic sources. When you visit these sites through Onion Browser, you will face CAPTCHA challenges, sometimes multiple times per session. Some services block Tor entirely, showing an error page instead of the login form.

What this means for you: Plan extra time for any task that involves logging into accounts or filling forms. Some sites require you to solve a CAPTCHA, then log in, then solve another CAPTCHA before you can post or download. If a site blocks Tor completely, you cannot bypass the block without switching to a normal browser and revealing your IP address.

Outdated directories and limited search

No search engine indexes more than a fraction of active .onion sites, and most public directories are years out of date. You will find lists of .onion addresses on forums and wikis, but expect half the links to return timeouts [for more on finding working addresses, see Dark Web Onion Links: What You Need to Know]. Tor does not have a centralised registry, so there is no authoritative way to discover new sites beyond word of mouth and community-maintained lists.

What to check when a site times out:

• Confirm the address is a fifty-six-character v3 onion, not a sixteen-character v2.

• Tap 'New Identity' in Onion Browser to rebuild your circuit and retry.

• Search for the site's name on a clearnet forum or Tor community board to see if others report it as down.

• Wait ten minutes and try again—some .onion services restart automatically after brief outages.

Expect interruptions, delays, and dead links. .onion sites are experimental infrastructure run by individuals, not commercial hosting companies, and reliability reflects that reality.

Common Mistakes and Misconceptions

Assuming Onion Browser protects all traffic on your iPhone

Many users install Onion Browser expecting every app and connection on their device to route through Tor. Onion Browser only tunnels traffic within the Onion Browser app itself; anything outside the app continues to use your normal connection[3]. iOS also retains control over some network traffic, so audio or video embeds may route via your normal connection rather than over Tor[3]. To protect other apps, you would need a separate VPN or system-wide Tor solution, and even then iOS restrictions apply.

Believing Tor makes you completely anonymous

Tor hides your network path, but it cannot hide what you type, which accounts you open, or which files you download. If you log into a website you normally use outside Tor, that site may identify you and know you are using Tor[3]. Your ISP can also see that you are using Tor even if it cannot tell exactly what you are doing[6]. Anonymity depends on consistent behaviour, not just on installing the browser.

Confusing legality with safety

Using Tor is not illegal in the United States, and government actors depend on it—for example, the CIA hosts a website within Tor[6]. In Germany, browsing the dark net alone is not illegal, but you become liable to prosecution as soon as you consume or download illegal content or purchase illegal goods and services[7]. The legal status of the network does not make every activity on it lawful, and the distinction matters when you decide what to click.

Expecting desktop Tor Browser features on iOS

Onion Browser cannot use the Firefox Gecko engine that Tor Browser on desktop and Android uses because Apple requires all iOS web browser apps to use WebKit[3]. As a result, some fingerprinting protections and browser behaviours differ from the desktop version. The app has included an in-app Tor since version 3.1, but only on iOS 17 and later[8]. Check your iOS version before assuming the same protections apply.

Assuming a VPN and Onion Browser provide the same protection

A VPN routes your traffic through a single provider that can see your real IP address and destination. Tor routes your traffic through three volunteer-run relays, and each relay knows only its predecessor and successor[5]. Your traffic is encrypted three times as it passes over the Tor network[4]. These are different threat models: a VPN hides your activity from your ISP but trusts the VPN provider, while Tor distributes trust across multiple relays.

Thinking slow speeds mean the app is broken

Web browsing over Tor is much slower than through a normal browser or a VPN because your traffic is encrypted and relayed through the Tor network[1]. A page that loads in two seconds on Safari may take fifteen seconds or more in Onion Browser, and some sites time out entirely. This is expected behaviour, not a defect in the app. If a page fails to load, rebuild your circuit in the app settings and try again before assuming the site is down.

What to Remember

• Onion Browser routes only traffic inside the app through Tor; other apps on your iPhone keep using your normal connection[3].

• Logging into personal accounts, resizing the window, or opening downloaded files can expose your identity even while the browser is running.

• Slow page loads, CAPTCHAs, and dead .onion links are expected behavior, not signs that the app is broken.

• The official app is free and does not request contacts, camera, or microphone access; anything else is a different product[1][2].

• Using Tor is not illegal in the UK, but downloading or purchasing illegal content over it remains a criminal offense.

Start by checking your iOS version and installing Onion Browser only from the Apple App Store, then set the security level to block scripts before your first .onion visit. For a plain-language explanation of what the network itself is, see Dark Web Definition: What You Should Know.