The Tor Browser app is the official mobile version of Tor Browser, built to route your traffic through the Tor network so your browsing activity is harder to trace back to you. It is a legitimate tool for anonymous browsing, but it does not make you completely invisible or protect against every threat.
Encrypts your traffic three times as it passes through three volunteer-run relays
Blocks trackers, fingerprinting scripts, and cookies that try to identify you across sites
Lets you access regular websites and .onion services from one app
You still need to follow safe browsing habits, because the app cannot hide what you type into a website or stop a site from recognizing you if you log in.
What the Tor Browser App Actually Is
The Tor Browser app is the official mobile and desktop browser developed by the Tor Project, a non-profit organization. It is not a VPN wrapper or a third-party tool that simply tunnels your existing browser through a proxy. The app is built on Firefox ESR (Extended Support Release), which means it inherits Firefox's core rendering engine and security updates, then adds layers of privacy protections specific to the Tor network.
You download the official app directly from the Tor Project's website for desktop (Windows, macOS, Linux) or from the Google Play Store and Apple App Store for mobile devices. On iOS, the official client is called Onion Browser, because Apple's policies prevent the Tor Project from distributing a full Firefox-based browser on that platform. Every other listing that claims to be 'Tor Browser' on an app store is either a fork, a repackaged version, or an unrelated app using the Tor name for marketing.
Why the Official App Matters
The official Tor Browser is free and open-source, which means anyone can inspect the code to verify it does what it claims. Third-party apps may insert tracking code, sell your data, or fail to route traffic through the Tor network at all. If you see a Tor Browser listing on an app store that is not published by the Tor Project (or Onion Browser by Mike Tigas on iOS), treat it as unverified.
The app does not require an account, does not collect logs of your browsing history, and does not ask for payment. If an app claiming to be Tor Browser charges a subscription fee or requests personal information during setup, it is not the official client. For step-by-step instructions on obtaining the legitimate version, see How to Download Tor: A Step-by-Step Guide.
How Tor Browser Routes Your Traffic
When you open a website in the Tor Browser app, your request does not travel directly to the destination server. Instead, the app wraps your data in three layers of encryption and sends it through a chain of three volunteer-run relays—an entry node, a middle relay, and an exit node. Each relay removes one layer of encryption, like peeling an onion, which is why the technique is called onion routing.
The entry node sees your real IP address but cannot read the content of your request or know which website you are visiting. The middle relay sees traffic coming from the entry node and forwards it to the exit node, but it cannot see your IP address or the final destination. The exit node removes the last layer of encryption and sends your request to the website, so it can see the destination and the content of your traffic—but it does not know your IP address or which entry node you used.
What Each Relay Can and Cannot See
Entry node: your IP address, the fact that you are using Tor, but not the website you are visiting.
Middle relay: encrypted traffic from the entry node, forwarded to the exit node; no visibility into your identity or destination.
Exit node: the website you are visiting and any unencrypted data you send (for example, HTTP requests or form submissions without HTTPS).
If you visit a news site over HTTP from a network that blocks certain domains, the exit node can read the page content and the site's address, but it cannot link that activity back to your device. Your internet provider sees only that you connected to a Tor entry node, not which site you accessed. The news site sees the exit node's IP address, not yours.
When Exit Nodes See Your Data
Exit nodes handle the final hop to the destination, so they can inspect any traffic that is not protected by HTTPS. If you submit a login form on an HTTP page, the exit node can capture your username and password. The Tor Browser app includes HTTPS-Only mode by default, which forces every site to load over HTTPS when available, encrypting your data end-to-end so the exit node sees only the domain name, not the content. You should leave this setting enabled and avoid entering sensitive information on sites that do not support HTTPS.
Key Privacy and Security Features
The Tor Browser app includes several built-in protections that go beyond routing your traffic through the Tor network. These features work together to reduce the amount of information websites can collect about you, but they do not guarantee complete anonymity or protect you if you voluntarily share identifying details.
NoScript and JavaScript Control
NoScript is enabled by default in the app's 'Safer' and 'Safest' security levels. It blocks JavaScript, Flash, and other active content on all sites unless you explicitly allow them. JavaScript can reveal your time zone, screen resolution, installed fonts, and other details that help websites fingerprint your browser. When you visit a site that requires JavaScript to function—such as a web-based email client or a streaming service—you can temporarily permit scripts for that domain, but doing so increases the risk that the site will collect enough data to distinguish your session from others.
If you browse the dark web or access .onion services, keeping NoScript active prevents malicious scripts from exploiting browser vulnerabilities or leaking your real IP address through WebRTC or similar technologies. For everyday browsing, the trade-off is that some pages will not display correctly until you adjust the security level or whitelist the domain.
HTTPS-Only Mode
The app forces every site to load over HTTPS when the secure version is available. If a site does not support HTTPS, you see a warning before the connection proceeds. This setting ensures that exit nodes cannot read the content of your traffic, even though they handle the final hop to the destination. Without HTTPS, an exit node operator or anyone monitoring that relay can capture form submissions, cookies, and page content in plain text.
HTTPS-Only mode does not hide which domain you are visiting—DNS queries and the Server Name Indication (SNI) field in the TLS handshake still reveal the hostname—but it does encrypt the data you send and receive. You should never disable this feature, especially when logging into accounts or submitting payment information.
Automatic Cookie Clearing and Circuit Isolation
The Tor Browser app deletes all cookies, site data, and browsing history when you close the app or create a new identity using the onion icon in the toolbar. This prevents websites from tracking you across sessions using persistent identifiers. Within a single session, the app uses circuit isolation: each website you visit is assigned a separate path through the Tor network, so an exit node that sees traffic to one site cannot link it to your activity on another domain.
Circuit isolation does not protect you if you log into the same account on multiple sites, because the account itself becomes the identifier. If you sign into a social media platform and then visit a news site that embeds a tracking pixel from that platform, the social network can correlate the two sessions even though they used different Tor circuits. To maintain separation, you need to avoid logging into accounts or use a different Tor Browser profile for each identity. For guidance on setting up isolated workflows, see How to Access the Dark Web: A Step-by-Step Guide.
Protection Against Fingerprinting
The app standardizes many browser characteristics—window size, fonts, language settings, HTTP headers—so that every Tor Browser user looks similar to websites attempting to fingerprint visitors. When you resize the window, the app snaps to a set of predefined dimensions to prevent sites from using your screen resolution as a unique identifier. It also disables WebGL, canvas fingerprinting, and other APIs that reveal hardware or software details.
These protections reduce the uniqueness of your browser, but they do not eliminate it. If you install extensions, change advanced settings, or allow JavaScript on every site, you introduce variations that make your session easier to distinguish. The safest approach is to use the default configuration and accept that some sites will not work as expected.
Official Tor Browser App vs. Imitation Apps
App stores host dozens of listings that use the Tor name, but only a few are published by the Tor Project or its authorized developers. Fake apps typically charge for downloads, bundle unrelated VPN services, or collect data under the guise of privacy protection. If you install the wrong app, your traffic may never reach the Tor network, or the app may log your browsing history and sell it to third parties.
Signs of a Fake or Misleading App
You can identify imitation apps by checking for these warning signs before you download:
Paid downloads or in-app subscriptions: The official Tor Browser is free on every platform. If an app charges a one-time fee or monthly subscription, it is not the legitimate client.
Bundled VPN claims: Listings that advertise 'Tor + VPN in one app' or 'faster Tor with built-in VPN' are third-party tools, not the official browser. The Tor Project does not combine VPN functionality with Tor Browser.
Vague or generic developer names: The official Android app is published by 'The Tor Project' on Google Play. On iOS, the authorized client is Onion Browser by Mike Tigas. Any other developer name—such as 'Privacy Labs', 'Secure Browser Team', or a single-word alias—indicates an unofficial fork or unrelated app.
Missing open-source links: The official app's store listing includes a link to the Tor Project's source code repository. If the listing does not mention open-source licensing or provide a way to inspect the code, treat it as unverified.
No support link to torproject.org: Legitimate apps link to the Tor Project's official support pages or documentation. Apps that direct you to a separate website, a social media account, or a generic contact form are not affiliated with the Tor Project.
How to Verify the Official App
Before you install, follow this verification path to confirm you have the correct listing:
Visit torproject.org/download on a desktop or mobile browser. The Tor Project's download page lists the official app for each platform and links directly to the correct store listing.
Check the developer name on the app store page. For Android, it must say 'The Tor Project'. For iOS, look for 'Onion Browser' by Mike Tigas—the Tor Project endorses this app because Apple's policies prevent a full Firefox-based browser on iOS.
Confirm the support link in the app description. The official listing includes a link to support.torproject.org or the project's community forum. If the link goes to a different domain, the app is not legitimate.
Compare the package name (Android only). The official Tor Browser uses the package identifier
org.torproject.torbrowser. You can see this in the Play Store URL or by checking the app details in your device settings after installation.
If you already installed an app and want to verify it, open the app's 'About' or 'Settings' screen and look for a link to the Tor Project's website. Fake apps either omit this link or direct you to a third-party domain. When in doubt, uninstall the app and download again from the official source. For detailed installation steps, see How to Download Tor: A Step-by-Step Guide.
Why Third-Party Apps Are Risky
Imitation apps may route your traffic through a proxy server controlled by the developer, not through the Tor network. This setup lets the operator see every site you visit and any data you send, defeating the purpose of using Tor in the first place. Even apps that do connect to the Tor network can insert tracking scripts, modify page content, or inject ads into your browsing session. Because these apps are not open-source or audited by the Tor Project, you have no way to verify their behavior.
Some unofficial apps claim to improve speed or add features like built-in VPN or ad blocking. These modifications often weaken privacy protections by disabling NoScript, allowing third-party cookies, or changing the default security level. If you need additional features, configure them in the official Tor Browser or use separate tools that do not interfere with Tor's anonymity guarantees.
What the Tor Browser App Does Not Do
The Tor Browser app provides strong anonymity for your connection through the Tor network, but it does not protect every part of your online activity. Understanding these limitations helps you avoid mistakes that could expose your identity or put you at risk.
It Does Not Encrypt Traffic Beyond the Exit Node
Once your traffic leaves the final Tor relay—the exit node—and travels to the destination website, it is no longer encrypted by Tor. If the site uses HTTPS, your data remains protected end-to-end, but if the site loads over plain HTTP, anyone monitoring the connection between the exit node and the server can read your traffic. The Tor Browser app's HTTPS-Only mode reduces this risk by refusing to load HTTP sites unless you override the warning, but it cannot force a site to support HTTPS if the site does not offer it. You should treat any HTTP site as unsafe for sensitive data, even when accessed through Tor.
It Does Not Hide the Fact That You Are Using Tor
Your internet service provider, network administrator, or anyone monitoring your connection can see that you are connecting to a Tor relay. The list of Tor entry nodes is public, so identifying Tor traffic is straightforward. The Tor Browser app does not disguise this fact—it prioritizes anonymity over stealth. If you need to hide Tor usage itself, you must configure a bridge or combine Tor with a VPN, but those steps require separate tools and careful setup. The app alone will not prevent your ISP from knowing you use Tor.
It Does Not Protect Against Malware Downloads
The Tor Browser app routes your traffic through the Tor network and blocks many tracking scripts, but it does not scan files for malware or prevent you from downloading malicious software. If you download an executable, document, or archive from a .onion site or clearnet page, the app will not warn you if the file contains a virus, trojan, or spyware. Once you open the file outside the browser, it can access your real IP address, read files on your device, or send data to a remote server. You need separate antivirus software and should avoid opening downloads unless you trust the source and have verified the file's integrity.
It Does Not Make Every Site Safe
Visiting a site through Tor does not mean the site itself is trustworthy. Phishing pages, scam marketplaces, and honeypot services exist on both the clearnet and the dark web. The Tor Browser app cannot verify the legitimacy of a site or protect you from social engineering attacks. If you enter your real email address, payment details, or personal information on a malicious site, the site operator will have that data regardless of your anonymity. You must evaluate each site independently, use disposable credentials when possible, and never assume that Tor makes a dangerous site safe to use.
Is the Tor Browser App Safe to Use?
Safety with the Tor Browser app depends on two separate questions: whether the software itself is secure, and whether using it exposes you to legal or social risk. The app is open-source, audited by security researchers, and maintained by the Tor Project, which publishes security advisories whenever a vulnerability is discovered. You can review current issues and recommended updates at the Tor Project's official security page. The code undergoes regular scrutiny, so critical flaws are typically identified and patched quickly. From a software security perspective, the official app is as safe as any privacy tool can be—provided you download it from the correct source and keep it updated.
Security Risks: Exit Nodes and HTTPS
The Tor network itself introduces a specific risk: the exit node can see unencrypted traffic. When you visit a site over plain HTTP, the operator of the final relay in your circuit can read every request and response, including any data you submit. Documented cases have shown malicious actors running exit nodes to harvest passwords, session cookies, and other sensitive information from users who did not verify that sites were using HTTPS. The Tor Browser app mitigates this with HTTPS-Only mode, which refuses to load HTTP sites unless you explicitly allow it, but the protection only works if the destination site supports HTTPS. If you override the warning and proceed to an HTTP site, your data travels in the clear between the exit node and the server.
You should treat HTTPS as mandatory for any site where you log in, make a purchase, or share personal details. Even on .onion sites—which encrypt traffic end-to-end within the Tor network—you should check for HTTPS if the site offers a clearnet mirror or loads external resources. The app cannot force a site to use encryption; it can only warn you and block the connection by default.
Legal and Social Risk
Using Tor is legal in the United Kingdom, the United States, and most other countries, but it may draw attention from your internet service provider, employer, or government agencies that monitor network traffic. Your ISP can see that you are connecting to a Tor relay, even though it cannot see which sites you visit. In some jurisdictions, Tor usage alone is enough to trigger additional scrutiny or place you on a watchlist, even if you are not doing anything illegal. The Tor Browser app does not hide the fact that you are using Tor—it prioritizes anonymity over stealth.
If you need to conceal Tor usage, you must configure a bridge or use a VPN before connecting to the Tor network, but those steps require separate tools and careful setup. The app alone will not prevent your ISP from identifying Tor traffic. In countries where Tor is restricted or censored, using the app without additional precautions can result in blocked connections or legal consequences. Before you rely on the app for sensitive activity, research the legal status of Tor in your location and understand the risks of being identified as a Tor user.
Staying Informed
The Tor Project maintains a security advisories page where it discloses vulnerabilities, recommended updates, and known threats. You should check this page periodically and enable automatic updates on your device so that you receive patches as soon as they are released. No software is perfectly safe, but the Tor Browser app's transparency and active maintenance make it one of the most trustworthy tools for anonymous browsing—as long as you understand its limitations and use it within a broader security strategy.
How to Install and Verify the Official App
Installing the Tor Browser app correctly is the first step toward safe anonymous browsing. The process differs by platform, but the principle remains the same: download only from official sources, verify the developer, and confirm the app version before you open it.
Desktop Installation and Verification
On Windows, macOS, or Linux, visit torproject.org/download and select your operating system. The site will offer a direct download link for the latest stable release. After the file downloads, verify its cryptographic signature before you run the installer. The Tor Project publishes PGP signatures for every release, and the download page includes instructions for checking them using GnuPG or a similar tool. This step confirms that the file has not been modified since the Tor Project signed it. If you skip signature verification, you risk installing a tampered version that could log your activity or compromise your anonymity.
Once you verify the signature, run the installer and follow the prompts. The desktop app does not integrate with your system browser—it runs as a standalone application with its own profile and settings. After installation, open the app and check the 'About Tor Browser' screen to confirm the version number matches the latest release listed on torproject.org. If the version is outdated or the 'About' screen does not link to the Tor Project's website, delete the application and download again.
Android Installation Checklist
Open the Google Play Store and search for 'Tor Browser'.
Confirm the developer name is 'The Tor Project'.
Check the package name in the URL: it must be
org.torproject.torbrowser.Verify the support link in the description points to support.torproject.org.
Install the app, then open 'Settings' → 'About' and confirm the version matches the current release on torproject.org.
If you cannot access the Play Store, the Tor Project offers a direct APK download from torproject.org/download. After downloading the APK, enable 'Install unknown apps' for your browser in Android settings, then install the file. Check the signature using the instructions on the download page before you proceed.
iOS Installation Checklist
Open the App Store and search for 'Onion Browser'.
Confirm the developer is Mike Tigas.
Check the description for a link to onionbrowser.com or support.torproject.org.
Install the app, then open 'Settings' → 'About' and verify the version.
Apple's policies prevent a full Firefox-based Tor Browser on iOS, so the Tor Project endorses Onion Browser as the recommended alternative. It uses the Tor network and applies similar privacy protections, but it is not identical to the desktop or Android app. If you need the full feature set, use Tor Browser on a desktop or Android device instead. For a complete walkthrough of installation steps across all platforms, see How to Download Tor: A Step-by-Step Guide.
After installation, open the app and connect to the Tor network. The first connection may take thirty seconds to a minute while the app builds a circuit. Once connected, visit check.torproject.org in the browser to confirm your traffic is routed through Tor. If the page displays 'Congratulations. This browser is configured to use Tor', your installation is correct and you can begin browsing.
Common Mistakes When Using Tor Browser
Even when you download the official Tor Browser app and verify its signature, small errors in how you use it can undermine your anonymity. Most mistakes involve habits carried over from regular browsing—logging into accounts, customizing the interface, or treating Tor like a VPN. Each misstep creates a unique pattern that can link your sessions or reveal your identity. Understanding these errors and their consequences will help you avoid them.
Logging Into Personal Accounts
When you sign in to Facebook, Gmail, or any service tied to your real identity, you connect your Tor session to your person. The site operator knows exactly who you are because you provided your credentials. If you later visit another site in the same Tor Browser session, both sites may share tracking data or your browsing pattern could be correlated by a third party monitoring exit nodes. Circuit isolation in Tor Browser helps by assigning different circuits to different domains, but it cannot prevent you from voluntarily identifying yourself.
The correct approach: create separate accounts with disposable email addresses and never log in to personal services through Tor unless you intend to link that session to your identity. If you must access a personal account, open it in a new Tor Browser window after restarting the app, and do not visit any other sites in that session.
Maximizing the Browser Window
Tor Browser opens at a standard size to make every user's window dimensions identical. When you maximize the window or manually resize it, your screen resolution becomes visible to any site that queries window.innerWidth and window.innerHeight. This measurement is part of your browser fingerprint—a set of attributes that can distinguish you from other Tor users. If your resolution is uncommon, it may be enough to track you across sessions even when your IP address changes.
The app warns you with a message when you try to resize the window: 'Maximizing Tor Browser can allow websites to determine your monitor size, which can be used to track you.' Ignore this warning at your own risk. Keep the window at its default size, or accept that you are making yourself easier to identify.
Installing Browser Extensions
Tor Browser includes NoScript and HTTPS Everywhere by default. Adding third-party extensions—ad blockers, password managers, translation tools—introduces new code that can bypass Tor's protections, leak your real IP address, or create a unique fingerprint. Extensions may send telemetry to their developers, request permissions that expose your browsing history, or load resources from outside the Tor network. The Tor Project explicitly advises against installing any additional extensions.
If you believe you need an extension, ask yourself whether the feature is worth the risk. In most cases, the answer is no. Use a separate browser for tasks that require extensions, and keep Tor Browser unmodified.
Opening Downloaded Files While Online
When you download a file through Tor Browser and open it while still connected to the internet, the file can execute scripts, load remote images, or contact external servers using your real IP address. PDF readers, office suites, and media players often fetch updates, verify licenses, or render embedded content by connecting directly to the internet—bypassing Tor entirely. This behavior leaks your location and links the download to your identity.
The safe method: disconnect from the internet or shut down Tor Browser before you open any downloaded file. Better still, transfer the file to an offline device or a virtual machine with no network access, then inspect it there. Treat every download as potentially hostile until you verify its contents.
Confusing Tor with a VPN
Tor Browser routes your traffic through three relays and changes your IP address, but it does not encrypt all traffic leaving your device. A VPN, by contrast, encrypts your entire connection to a single server and replaces your IP address with the server's address. The two tools serve different purposes: Tor prioritizes anonymity by distributing trust across multiple relays, while a VPN prioritizes privacy by hiding your activity from your ISP and local network.
Using Tor Browser does not protect non-browser traffic—your operating system, background apps, and other programs will still use your real IP address. If you torrent a file, check your email, or run a system update while Tor Browser is open, those activities are not routed through the Tor network. You must configure your entire system to use Tor, or accept that only the browser itself is anonymous. Do not assume that opening Tor Browser makes your whole device private.
Tor Browser App vs. VPN: What the Difference Means in Practice
Tor Browser and a VPN both change your IP address, but they protect different parts of your connection and hide your activity from different observers. Understanding what each tool conceals—and from whom—helps you choose the right one for your situation.
What Each Tool Hides
Tor Browser routes your traffic through three relays in the Tor network. The first relay sees your real IP address but not your destination. The exit node sees your destination but not your IP. No single relay knows both ends of the connection, so your browsing remains anonymous as long as you do not identify yourself through login credentials or unique behavior. Websites see the exit node's IP address, not yours, and each new circuit assigns a different exit node.
A VPN encrypts all traffic between your device and the VPN server, then forwards it to the destination. Your ISP and local network see only that you are connected to the VPN—they cannot read the content of your traffic or identify the sites you visit. The destination site sees the VPN server's IP address instead of yours. The VPN provider, however, can see both your real IP and every site you access, so you are trusting a single company with your entire browsing history.
When to Use Each Tool
| Your Goal | Recommended Tool | Reason |
|---|---|---|
| Access .onion sites | Tor Browser app | VPNs cannot reach onion services; only the Tor network supports them. |
| Hide browsing from ISP | VPN | Encrypts all device traffic; faster than Tor for everyday use. |
| Remain anonymous to websites | Tor Browser app | Distributes trust across relays; no single entity knows your identity and activity. |
| Protect non-browser traffic | VPN | Tor Browser routes only browser traffic; other apps use your real IP. |
| Bypass censorship | Tor Browser with bridges or VPN | Depends on what your network blocks; try bridges first, then a VPN if Tor is detected. |
Neither tool is universally better. Tor Browser prioritizes anonymity by ensuring no single party can link your identity to your activity. A VPN prioritizes privacy by hiding your traffic from local observers, but you must trust the VPN provider not to log or sell your data. If your threat model includes state-level surveillance or targeted investigation, Tor's distributed trust offers stronger protection. If you simply want to prevent your ISP from monitoring your browsing or access region-locked content, a VPN is faster and easier to use.
You can combine both tools—connecting to a VPN before opening Tor Browser—but this setup adds complexity and does not always improve security. The VPN hides your Tor usage from your ISP, which matters in countries where using Tor is suspicious, but it also means the VPN provider knows you are a Tor user. The Tor Project neither recommends nor discourages this configuration; the decision depends on your specific risks. For most users, choosing one tool and using it correctly is more effective than layering both and introducing new points of failure.
Official Tor Browser App Verification Checklist
| Platform | Official Developer Name | Verification Step | Where to Check | Red Flag (Fake App) |
|---|---|---|---|---|
| Android | The Tor Project | Confirm developer in Google Play | App listing page, below title | Developer name differs or missing |
| Android | The Tor Project | Check package name org.torproject.torbrowser | Play Store URL or app info | Package name contains extra words |
| iOS | Mike Tigas | Search 'Onion Browser', verify developer | App Store listing | Developer is not Mike Tigas |
| iOS | Mike Tigas | Check description for onionbrowser.com link | App Store description section | No official website link present |
| Desktop | torproject.org | Download only from torproject.org | Browser address bar | Domain is not torproject.org exactly |
| Desktop | The Tor Project | Verify GPG signature of installer | Terminal or command prompt | Signature verification fails or skipped |
| All platforms | The Tor Project | Visit check.torproject.org after install | Inside Tor Browser after connecting | Page does not confirm Tor usage |
Common Mistakes and Misconceptions
Many people assume that installing the official Tor Browser app is enough to stay anonymous. In practice, most failures come from how the browser is used after installation, not from the software itself. The mistakes below are the ones we see most often in support forums and user reports. Each one creates a specific risk that you can avoid with a small change in behavior.
Believing any app called ‘Tor Browser’ is official
App stores contain several wrappers and clones that use the Tor network but are not maintained by the Tor Project. These apps may route traffic through Tor, but they can also inject ads, log your activity, or fail to update when critical security patches are released. The only official Android app is published by ‘The Tor Project’ with the package name org.torproject.torbrowser; on iOS there is no official Tor Browser, and the commonly recommended alternative is Onion Browser by Mike Tigas. Before installing anything, check the developer name and package identifier against the Tor Project’s own download page. If the developer name is missing or includes extra words, you are looking at a third-party product.
Assuming Tor Browser hides all device traffic
Tor Browser anonymizes only the traffic that passes through the browser itself. Your email client, system updates, torrent software, and any other application continue to use your real IP address while Tor Browser is open. A common failure scenario: someone opens Tor Browser, then downloads a file and opens it in a media player that contacts the internet directly, revealing their location. To protect non-browser traffic you would need to configure your entire operating system to route through Tor, which is a separate and more complex setup. Unless you have done that, treat Tor Browser as a single application with a protected tunnel, not as a privacy shield for the whole device.
Logging into personal accounts during a Tor session
Signing in to a service tied to your real identity—email, social media, banking—immediately links that Tor session to you. The site operator knows who you are because you provided your credentials, regardless of the exit node IP address. If you then visit other sites in the same session, a network observer or a cooperating set of sites may correlate those visits with the identity you just revealed. The safe pattern is to create separate, disposable accounts for use over Tor and never mix them with personal ones. If you must access a personal account, open it in a fresh Tor Browser session and do not visit any other sites before closing the app.
Installing extra browser extensions
Tor Browser ships with NoScript and HTTPS Everywhere preconfigured, and the Tor Project explicitly advises against adding more extensions. Third-party extensions can request permissions that expose your browsing history, send telemetry to their developers, or load resources outside the Tor network. Some extensions have been caught bypassing proxy settings and leaking the user’s real IP address. Even a reputable extension creates a more unique browser fingerprint, because most Tor users do not have it installed. Keep Tor Browser unmodified; if you need extensions for a specific task, use a separate browser that is not part of your anonymity workflow.
Maximizing or resizing the browser window
Tor Browser opens at a standardized window size so that every user reports the same dimensions to websites. When you maximize the window or drag its edges, the browser can reveal your actual screen resolution through properties like window.innerWidth and window.innerHeight. That value becomes part of your fingerprint and can distinguish you from other Tor users, especially if your monitor has an unusual resolution. The app shows a warning when you attempt to resize, and ignoring it means accepting a weaker anonymity set. Leave the window at its default size for every session.
Confusing Tor with a VPN
A VPN encrypts all traffic from your device and sends it through a single server operated by one company; that company can see both your real IP address and the sites you visit. Tor distributes trust across three independent relays so that no single relay knows both who you are and where you are going. This difference matters when you choose a tool: Tor is better at preventing any one party from linking your identity to your activity, while a VPN is better at hiding all device traffic from your ISP. Using Tor Browser does not give you VPN-like coverage of your whole system, and using a VPN does not give you Tor’s distributed trust. Choose based on what you need to hide and from whom, not on the assumption that both tools do the same thing.
Common questions
Is Tor a free Browser?
Yes, Tor Browser is free to download and use on Android, desktop, and other supported platforms. The Tor Project develops it as open-source software, so anyone can inspect the code or contribute. You will not be asked to pay, subscribe, or register an account to browse. If an app store listing asks for payment or a subscription, treat it as a red flag and check the developer name against the official Tor Project page.
How to download Tor Browser on Android?
Open Google Play on your Android device and search for 'Tor Browser'. Check that the developer is listed as 'The Tor Project' and the package name is org.torproject.torbrowser before installing. You can also download the APK directly from torproject.org if you cannot access Google Play, but verify the file's GPG signature before opening it. After installation, open the app and tap 'Connect' to start your first Tor circuit.
Which Tor Browser app is real?
On Android, the real app is published by 'The Tor Project' with the package name org.torproject.torbrowser. On iOS, there is no official Tor Browser; the commonly recommended alternative is Onion Browser by Mike Tigas, and you should verify the developer name and the onionbrowser.com link in the App Store description. Any app with a different developer name, extra words in the package name, or no link to the official site is a third-party product. After installing, open the app and visit check.torproject.org to confirm you are connected through the Tor network.
Conclusions
Verify the developer name and package identifier before you install; on Android, that is The Tor Project and
org.torproject.torbrowser.The official Tor Browser app protects only traffic inside the browser; other apps still use your real IP address.
Keep the app unmodified: no extra extensions, no window resizing, and no personal account logins during anonymous sessions.
Tor splits trust across three independent relays, so a single relay cannot connect your identity to the sites you visit.
Tor is not a VPN and does not hide non-browser traffic from your ISP.
Start with the official download: How to Download Tor: A Step-by-Step Guide walks you through verifying the source, then open the app and check your connection at check.torproject.org.
Explore More About Privacy Tools
Discover additional resources and tips on staying safe online.
Visit Our ResourcesWhere to look next
We collect these links for readers who want to compare options. Verified links.
How to Access the Dark Web: A Step-by-Step GuideLearn how to access the dark web safely with our step-by-step guide, covering essential tools and precautions for a secure experience.
Dark Website Browser: Choosing the Right ToolDiscover the safest dark website browsers to enhance your online privacy and navigate the dark web securely.
Tor App: Your Gateway to the Dark WebDiscover the Tor app, your secure gateway to the dark web, enabling safe access to .onion sites while protecting your privacy.