Understanding the Tor Web: What You Need to Know

What Tor Web Actually Means

When you hear 'Tor web', you're actually hearing about two connected things: the Tor network itself and the Tor Browser that most people use to access it.

The Tor network is a system of volunteer-run relays that routes your internet traffic through multiple computers before it reaches its destination. The Tor Browser is the free application you download to connect to that network. You can use Tor Browser to visit regular websites like BBC or Wikipedia, or to access .onion sites—special addresses that only work inside the Tor network. People often call .onion sites 'the dark web', but Tor is simply the tool that lets you reach them, not the dark web itself.

How Onion Routing Works

Tor gets its name from 'The Onion Router', and the onion metaphor explains how it protects your connection. Your traffic is wrapped in three layers of encryption, like layers of an onion. It then passes through three volunteer relays in sequence:

• Entry node (guard relay): sees your real IP address but doesn't know where you're going

• Middle relay: knows the entry and exit nodes but doesn't see your IP or final destination

• Exit node: sends your request to the website but doesn't know your real IP

No single relay knows both who you are and where you're going. The entry node sees your IP but not your destination. The exit node sees your destination but not your IP. The middle relay sees neither. This separation is what makes Tor different from a simple proxy or VPN, where one company sees everything.

If you visit a .onion site, there's no exit node—the connection stays inside the Tor network the entire time, adding another layer of protection.

For more on what .onion addresses are and how they differ from regular websites, see Dark Web Onion: Understanding Its Role.

What Tor Does and Does Not Hide

Tor protects specific parts of your connection, but not everything. Understanding the boundary helps you use it safely and avoid assumptions that could put you at risk.

What Tor Protects

Tor hides your browsing destination from your ISP and local network. When you connect through Tor, your internet provider sees only that you're using Tor—not which sites you visit. It also hides your real IP address from the websites you visit, since they see only the exit node's IP. Most importantly, Tor prevents anyone from linking your activity to your identity at the network level, as long as you don't log into accounts or reveal personal information yourself.

What Tor Does Not Protect

Tor does not encrypt the content of your traffic after it leaves the exit node. If you visit an HTTP site (not HTTPS), the exit relay operator can see everything you send and receive. Tor also does not stop browser fingerprinting—websites can still try to identify you based on your browser configuration, screen size, fonts, and other details. It does not protect you from malware or malicious sites, and it does not hide your identity on sites you log into. If you sign into Facebook or Gmail through Tor, those companies know it's you.

Tor also cannot prevent timing and correlation attacks. If an adversary monitors both your internet connection and the site you visit, they may correlate the timing of traffic to link you to your activity, even without seeing the content.

If you visit a .onion site, your connection never leaves the Tor network, so there's no exit node to monitor unencrypted traffic. This is one reason .onion sites offer stronger privacy than regular websites accessed through Tor.

The Difference Between the Tor Network, Tor Browser, and the Dark Web

People use 'Tor', 'dark web', and 'Tor Browser' interchangeably, but they refer to three separate things. Mixing them up leads to confusion about what Tor actually does and what risks you face when you use it.

The Tor Network

The Tor network is the infrastructure—thousands of volunteer-run relays that route your traffic through multiple hops. It's a distributed system with no central server. Anyone can run a relay, and the network automatically selects three relays for each connection you make. The network itself is just the collection of these relays and the protocol that governs how they communicate.

Tor Browser

Tor Browser is a modified version of Firefox ESR bundled with the software needed to connect to the Tor network. When you download Tor Browser from the Tor Project, you get a pre-configured application that routes all your traffic through the network by default. It also includes privacy protections like blocking third-party trackers, resisting fingerprinting, and isolating each website you visit. You can use Tor Browser to visit ordinary websites—BBC, Reddit, DuckDuckGo—just as you would in Chrome or Firefox, but your connection goes through the Tor network first.

Most Tor usage is exactly this: browsing regular websites with added privacy. You don't need to visit .onion sites to benefit from Tor.

The Dark Web

The dark web is any overlay network that requires specific software to access. Tor's .onion sites are one part of the dark web, but they're not the only part. I2P, Freenet, and other networks also host content that standard browsers cannot reach. When journalists or law enforcement talk about 'the dark web', they usually mean .onion sites on Tor, but the term is broader than that.

For a detailed explanation of what the dark web includes and how it differs from the deep web, see Dark Web Definition: What You Should Know.

.onion sites are only accessible through Tor Browser or another Tor-enabled client. They exist entirely within the Tor network, so there's no exit node involved—your connection never touches the regular internet. This makes .onion sites more private than visiting a regular website through Tor, since no exit relay can monitor your traffic.

You can use Tor without ever visiting a .onion site, and you can use Tor Browser to access regular websites with no connection to the dark web. The two are linked in public perception, but they're separate in practice.

Is Tor Legal and Safe to Use?

Tor itself is legal in most countries. You can download Tor Browser, connect to the network, and browse websites without breaking any law in the UK, United States, Canada, most of Europe, and many other jurisdictions. The software is open-source, maintained by a non-profit organisation, and used by journalists, activists, researchers, and ordinary people who want privacy online.

However, some countries restrict or ban Tor entirely. China, Russia, Iran, and Venezuela have documented restrictions that make it difficult or illegal to use Tor within their borders. In these places, your internet provider may block connections to the Tor network, or you may face legal consequences for attempting to use it. If you're travelling or living in a country with internet censorship, check local laws before you connect.

Using Tor vs. Doing Illegal Things on Tor

Using Tor is not the same as engaging in illegal activity. The distinction matters because many people assume that Tor itself is illegal or that anyone using it must be hiding criminal behaviour. In reality, most Tor users visit ordinary websites with added privacy, or they access .onion sites that host legitimate content—news outlets, privacy tools, whistleblowing platforms, forums.

That said, Tor does not make illegal activity legal, and it does not make you undetectable. Law enforcement agencies have documented methods for deanonymising Tor users in specific cases. These methods include:

• Monitoring both ends of a connection (your ISP and the website you visit) to correlate timing patterns

• Exploiting vulnerabilities in Tor Browser or the websites you visit

• Running malicious exit nodes to capture unencrypted traffic

• Using subpoenas and legal pressure to identify users who log into accounts or reveal personal information

If you commit a crime over Tor, you can still be caught. Tor makes surveillance harder, not impossible.

Downloading Tor Browser Safely

Tor Browser is safe to download from the official Tor Project website at torproject.org. The organisation provides verified downloads with cryptographic signatures you can check to confirm authenticity. Fake or bundled versions of Tor Browser are a real risk. Malicious actors distribute modified versions that include spyware, remove privacy protections, or route your traffic through compromised relays. These fake versions often appear on third-party download sites, torrent trackers, or app stores that don't verify software integrity.

To download Tor Browser safely:

1. Go directly to torproject.org—do not use search results or third-party mirrors

2. Download the version for your operating system (Windows, macOS, Linux, or Android)

3. Verify the signature if you know how, or at minimum check that the download came from torproject.org

4. On iOS, use Onion Browser from the App Store, which is endorsed by the Tor Project

Never download Tor Browser from unofficial sources, and never install browser extensions or plugins that claim to 'enhance' Tor. These additions can break Tor's privacy protections or introduce new risks.

If you're not sure whether your copy of Tor Browser is genuine, visit check.torproject.org after you connect. The page will confirm whether you're using Tor correctly and whether your browser configuration is safe.

Common Mistakes When Using Tor and How to Avoid Them

Tor protects your privacy when you use it correctly, but a handful of common mistakes can expose your real identity or location. Most of these errors come from habits you've developed browsing without Tor—actions that feel harmless but break the anonymity Tor provides. Here's what to watch for and how to fix it.

Logging Into Personal Accounts

If you sign into Google, Facebook, your bank, or any other account tied to your real identity while using Tor, you've told that service exactly who you are. Tor hides your IP address from the website, but the moment you log in, the site knows your identity anyway. The company can now link your Tor session to your account, your past activity, and any other data they hold about you.

This doesn't mean Tor failed—it means you chose to identify yourself. If you need to use Tor to access a service, create a separate account with no connection to your real name, email, or phone number. Never log into personal accounts through Tor unless you're comfortable with the service knowing you're the same person.

Downloading and Opening Files While Connected

When you download a file through Tor and open it—especially a PDF, Word document, or video—the application that opens it may connect to the internet to fetch fonts, images, or updates. These connections often bypass Tor entirely and reveal your real IP address. The file itself may also contain embedded tracking links or scripts that phone home when opened.

The safest approach: disconnect from the internet before you open any file downloaded through Tor. If you must open it while connected, use a separate, isolated virtual machine with no direct internet access. Better still, avoid downloading files through Tor unless you have a specific reason and understand the risks.

Installing Browser Extensions or Enabling Plugins

Tor Browser is pre-configured to resist fingerprinting, and every user starts with the same settings. When you install an extension—even a privacy-focused one like an ad blocker or password manager—you change your browser's fingerprint and make yourself more identifiable. Extensions can also access your browsing history, inject code into pages, or leak information Tor is designed to hide.

Plugins like Flash, Java, and QuickTime are even worse. They can execute code outside the browser's sandbox and bypass Tor entirely. Tor Browser blocks these by default, and you should never enable them.

Use Tor Browser exactly as it's distributed. Don't add extensions, don't change security settings, and don't enable plugins. If you need additional tools, run them in a separate browser outside Tor.

Maximizing the Browser Window

Tor Browser opens in a specific window size to make every user look the same. If you maximize the window or resize it, websites can measure your screen resolution—a data point that helps fingerprint your device. Combined with other details like your time zone, language, and fonts, screen resolution can narrow down who you are.

Leave the Tor Browser window at its default size. If the small window feels awkward, adjust your workflow rather than resizing the browser. This is a small inconvenience that preserves your anonymity.

Using Tor with a VPN Without Understanding the Tradeoffs

Some people route Tor through a VPN (you connect to a VPN, then open Tor Browser) or route a VPN through Tor (you connect to Tor, then run a VPN client inside). Both configurations change who can see what, and neither is automatically better than using Tor alone.

If you connect to a VPN first, your ISP sees only the VPN, not Tor—but the VPN provider sees that you're using Tor and can log your connection times. If you connect to Tor first, your ISP sees Tor, and the VPN provider sees your traffic exiting Tor but not your real IP. Each setup shifts trust from one party to another.

For most people, Tor alone is enough. Adding a VPN introduces a new party who can monitor your activity, and it doesn't make you more anonymous unless you have a specific threat model that requires it. If you do use a VPN with Tor, understand exactly what each party can see and whether you trust them. Don't assume the combination is automatically safer.

For more on how .onion sites work and why they're more private than regular websites accessed through Tor, see Dark Web Onion: Understanding Its Role.

How to Verify You Are Using Tor Correctly

Connecting to Tor Browser doesn't automatically mean you're protected. You need to confirm that the network path is active, that your browser configuration hasn't been altered, and that your real IP address isn't leaking. These checks take less than two minutes and catch the most common setup errors.

Check the Connection Indicator

Open Tor Browser and look at the URL bar. You should see a small onion icon to the left of the address, or a padlock with the text 'Connection secure' when you visit an HTTPS site. If you see a warning triangle or a message saying 'Connection is not secure', the site you're visiting doesn't use encryption, and your traffic at the exit node is visible in plain text.

The onion icon confirms that Tor Browser is routing your connection through the Tor network. If you don't see it, you're not using Tor—you may have opened a regular browser by mistake.

Visit check.torproject.org

Type check.torproject.org into the address bar. The page will display one of two messages: 'Congratulations. This browser is configured to use Tor' or 'Sorry. You are not using Tor'. If you see the first message, the page will also show the IP address of your current exit node—this is the address websites see, not your real IP.

If the page says you're not using Tor, close the browser and reopen it. If the problem persists, uninstall Tor Browser and download a fresh copy from torproject.org. Never assume you're protected without checking this page at least once per session.

Confirm No Extensions Are Installed

Click the three horizontal lines in the top-right corner of Tor Browser, then select 'Add-ons and themes'. The list should be empty. If you see any extensions—even ones you trust—remove them immediately. Extensions change your browser fingerprint and can leak information that Tor is designed to hide.

Tor Browser is built to work without additions. If you've installed anything, you've reduced your anonymity.

Confirm the Browser Window Is at Default Size

Look at the Tor Browser window. It should open in a fixed size, not maximized to fill your screen. If you've resized or maximized it, websites can measure your screen resolution and use that to fingerprint your device.

To reset the window, close Tor Browser and delete the file 'prefs.js' in your Tor Browser profile folder. When you reopen the browser, it will return to the default size. From then on, leave it as it is.

Verify the Download Source

If you're checking Tor Browser for the first time, confirm you downloaded it from torproject.org. Open your browser's download history and check the source URL. If it came from any other domain—especially a third-party software site or torrent tracker—delete it and download a verified copy.

The Tor Project provides cryptographic signatures for every release. If you know how to verify signatures, download the signature file from torproject.org and check it against your downloaded installer using GPG. If you don't know how, at minimum confirm the download came directly from the official site.

What These Checks Do and Don't Prove

These steps confirm that Tor Browser is routing your traffic through the Tor network and that your configuration matches the default. They do not prove you're anonymous against all adversaries. A well-resourced attacker who monitors both your ISP and the websites you visit can still correlate traffic timing to identify you. Tor hides your IP address from websites and your browsing activity from your ISP, but it doesn't make you invisible to targeted surveillance.

If check.torproject.org says you're using Tor, your connection is working as designed. That's enough for most privacy threats, but not for every threat model.

Tor vs VPN: When Each Tool Makes Sense

Both Tor and VPNs hide your IP address from websites, but they do it in fundamentally different ways—and that difference determines which tool fits your situation.

A VPN encrypts all traffic between your device and a single server run by the VPN provider. That server then forwards your requests to the internet. Websites see the VPN server's IP address instead of yours, and your ISP sees only encrypted traffic to the VPN—they can't tell which sites you're visiting. The tradeoff: the VPN provider can see both your real IP address and every site you visit. You're trusting one company with a complete log of your activity.

Tor distributes that trust across three independent relays, none of which sees the full picture. Your entry node knows your IP but not where you're going. Your exit node sees your destination but not who you are. The middle relay sees neither. No single party—including the Tor Project—can link you to your browsing. That's stronger anonymity, but it comes with slower speeds and more friction: websites often block Tor exit nodes or demand CAPTCHAs, and streaming video rarely works well.

When to Use a VPN

Choose a VPN when you need everyday privacy from your ISP, want to access geo-restricted content, or need consistent speed for streaming and downloads. VPNs work well for:

• Hiding your browsing history from your internet provider or network administrator

• Bypassing regional content blocks on streaming services

• Protecting your traffic on public Wi-Fi

• Accessing work resources securely

VPNs are faster than Tor because your traffic takes one encrypted hop instead of three. Most websites treat VPN traffic the same as any other connection, so you won't face constant CAPTCHA challenges or access blocks.

The limitation: you're trusting the VPN provider not to log your activity, hand data to authorities, or suffer a breach. Many providers claim they don't keep logs, but you can't verify that claim. If the provider is compromised or compelled by law, your entire browsing history is available.

When to Use Tor

Choose Tor when you need anonymity rather than just privacy—when you can't afford to trust any single provider, or when the consequences of identification are serious. Tor is appropriate for:

• Whistleblowing or communicating with journalists

• Researching sensitive topics where even the act of looking can put you at risk

• Accessing .onion sites that exist only on the Tor network

• Evading censorship in countries that block VPNs

Tor is slower, and many sites will ask you to solve CAPTCHAs or block you outright. You'll need patience, and you should expect interruptions. But no single organisation—government, company, or attacker—can see both who you are and what you're doing.

Combining Tor and VPN: What Actually Changes

Some people run Tor over a VPN (connect to a VPN first, then open Tor Browser) or a VPN over Tor (connect to Tor, then run a VPN client). Each combination shifts what different parties can observe, but neither automatically makes you more anonymous.

Tor over VPN hides the fact that you're using Tor from your ISP. Your ISP sees only a VPN connection, and the VPN provider sees that you're connecting to a Tor entry node. The Tor network itself works exactly as it normally does—your entry node still sees your IP (now the VPN's IP), and websites still see your exit node. This setup is useful if your ISP or government blocks Tor, or if you don't want your ISP to know you're using it. The cost: the VPN provider knows you're using Tor and can log your connection times. If the provider is compromised, an attacker learns when you were online and can try to correlate that with Tor traffic.

VPN over Tor routes your VPN connection through the Tor network first. Your ISP sees you're using Tor. The Tor exit node sees encrypted VPN traffic but not your real IP. The VPN provider sees traffic coming from a Tor exit node, not your actual location. This setup is rare and complex to configure—most VPN apps won't work inside Tor Browser, so you'd need to set it up at the operating-system level. It's occasionally useful if you need to access a service that blocks Tor exit nodes but still want Tor's anonymity from the VPN provider. The cost: your ISP knows you're using Tor, and the setup is fragile—if the VPN connection drops, your real IP can leak.

For most people, these combinations add complexity without a clear benefit. Tor alone protects you from websites and your ISP seeing your activity. A VPN alone protects you from your ISP but requires trust in the provider. Combining them shifts trust and visibility but doesn't eliminate it. Use one or the other based on your threat model, and only combine them if you understand exactly what each party can see and why that matters to you.

How to Get Started with Tor Safely

Getting Tor Browser running correctly takes five steps: download from the official site, install, connect, check that the connection works, and understand the default security setting. The entire process takes about ten minutes, and you don't need technical experience to do it.

Download from the Official Source Only

Open your regular browser and go to torproject.org. Click 'Download Tor Browser' and select your operating system—Windows, macOS, or Linux. The download is around 90 MB and will save as an installer file.

Never download Tor Browser from a third-party software site, app store listing that isn't published by 'The Tor Project', or file-sharing service. Fake versions exist, and some contain malware or remove the privacy protections that make Tor useful. The only safe source is torproject.org.

If you know how to verify cryptographic signatures, download the signature file from the same page and check it using GPG before you install. If you don't, at minimum confirm the download URL in your browser's address bar matches torproject.org exactly.

Install and Open the Browser

Run the installer. On Windows, double-click the .exe file and follow the prompts. On macOS, open the .dmg file and drag Tor Browser to your Applications folder. On Linux, extract the archive and run the 'start-tor-browser' script.

When you open Tor Browser for the first time, you'll see a connection screen. Click 'Connect'. The browser will choose an entry node, build a circuit through the Tor network, and display the default start page when it's ready. This usually takes 10 to 30 seconds. If you're in a country that blocks Tor, click 'Configure Connection' instead and follow the prompts to use a bridge.

Check That Tor Is Working

Once the browser opens, type check.torproject.org into the address bar. The page will say either 'Congratulations. This browser is configured to use Tor' or 'Sorry. You are not using Tor'. If you see the first message, you're connected—the page will also show the IP address of your current exit node, which is what websites see instead of your real address.

If the page says you're not using Tor, close the browser and open it again. If the problem continues, uninstall and download a fresh copy from torproject.org.

Understand the Default Security Level

Tor Browser includes a security slider with three settings: Standard, Safer, and Safest. By default, it's set to Standard, which allows JavaScript, fonts, and most website features to work normally. This setting provides strong anonymity for everyday browsing, but it does allow websites to run scripts that could potentially exploit browser vulnerabilities.

To check or change the setting, click the shield icon in the top-right corner of the browser, then 'Change' next to 'Security Level'. Safer disables JavaScript on non-HTTPS sites and some font features. Safest disables JavaScript entirely, which breaks many sites but provides the strongest protection against browser-based attacks.

For most people, Standard is appropriate. If you're visiting unfamiliar sites or your threat model includes targeted attacks, consider Safer or Safest—but expect many sites to stop working.

Mobile Options: Android and iOS

On Android, download Tor Browser directly from the Google Play Store or from torproject.org. The official app is published by 'The Tor Project' and works the same way as the desktop version. Avoid any other app with 'Tor' in the name—many are unofficial, unverified, and may not route traffic through the Tor network at all.

On iOS, the Tor Project does not publish an official Tor Browser. Instead, they recommend Onion Browser, a separate app endorsed by the Tor Project and available in the Apple App Store. Onion Browser routes traffic through the Tor network and includes many of the same privacy protections, but it's built by a different developer and has some limitations compared to the desktop version. It's the best option available for iPhones and iPads, but it's not identical to Tor Browser.

Do not use any app labelled 'Tor Browser' on iOS unless it's explicitly recommended on torproject.org. Many are not connected to the Tor Project and do not provide real anonymity.

Once you've installed Tor Browser and confirmed it's working, you're ready to browse. Leave the window at its default size, don't install extensions, and check torproject.org whenever you're unsure whether your connection is active. That's all you need to start using the Tor network safely.

Common Mistakes and Misconceptions

Thinking Tor, Tor Browser, and the dark web are the same thing

People often use these three terms interchangeably because they first hear about them in the same article or video. Tor is the network—a system of volunteer-run servers that relay encrypted traffic through three hops. Tor Browser is a specific application that connects to that network and handles the encryption for you. The dark web is just a small collection of websites with .onion addresses that are only reachable through the Tor network. You can use Tor Browser to visit ordinary websites like bbc.co.uk without ever touching the dark web, and you can browse the dark web without understanding how the underlying network works. Keep the three concepts separate: the network, the tool, and the content.

Assuming the connection is working without checking

After installing Tor Browser, many people open it and start browsing because the start page loaded normally. A loaded page does not prove your traffic is routed through the Tor network—a misconfigured browser can display websites while still exposing your real IP address. Type check.torproject.org into the address bar and confirm the page says ‘Congratulations. This browser is configured to use Tor’ before you do anything else. If it says you are not using Tor, close the browser and reopen it, or reinstall from torproject.org. This single check takes ten seconds and confirms the entire reason you installed the software.

Logging into personal accounts while using Tor

It feels natural to sign into your email or social media while browsing through Tor, especially if you are already logged in on another browser. The problem is that the account itself identifies you—the website knows exactly who you are regardless of what IP address you appear to be using. If your goal is anonymity, logging into any account linked to your real name, phone number, or payment details defeats the entire purpose. Use Tor for reading and research without signing in, and keep personal accounts on your regular browser.

Opening downloaded files while still connected to Tor

Downloading a document or PDF through Tor Browser and then opening it immediately seems harmless. The risk is that many file types—PDFs, Word documents, videos—can contain code that makes a direct connection to the internet when opened, bypassing Tor entirely and revealing your real IP address. If you must download files through Tor, save them and disconnect from the network before opening them, ideally on a computer that has no internet connection. Never open a downloaded file while Tor Browser is still running and connected.

Installing browser extensions to feel safer

Adding an ad blocker or privacy extension to Tor Browser feels like an upgrade, but it does the opposite. Extensions can change how the browser behaves, making your connection fingerprint unique and identifying you across different sessions. The Tor Project builds Tor Browser with specific privacy protections already configured, and they explicitly advise against adding extensions. Leave the browser exactly as it is—the default setup is designed to make you look like every other Tor user, which is what protects you.

Believing Tor is illegal because it is associated with the dark web

Some people avoid Tor entirely because they have heard it is a criminal tool or that using it will put them on a watch list. In the United Kingdom, using Tor is legal, and many people use it for legitimate reasons like researching sensitive topics or protecting their privacy from advertisers. That said, some countries restrict or block Tor access, so the legal status depends on where you are physically located, not on the technology itself. Using Tor to commit a crime is illegal in the same way using a regular browser to commit a crime is illegal—the tool is not the problem. Check the laws in your own country before relying on Tor in a high-risk situation.

Key Takeaways

• Tor is the network, Tor Browser is the tool, and the dark web is just a small set of .onion sites that only work over Tor. You can use Tor for ordinary websites without ever visiting the dark web.

• Check your connection every time: type check.torproject.org into the address bar and confirm the page says ‘Congratulations. This browser is configured to use Tor’ before you browse anything else.

• Tor hides your IP address and browsing route from websites, but it does not hide the fact you are using Tor from your ISP, and it does not protect unencrypted HTTP content from the exit node.

• Do not log into personal accounts, open downloaded files while connected, or install extensions. Each of these can identify you or leak your real IP address.

• Using Tor is legal in the United Kingdom. The tool is not the problem—what you do with it determines legality.

Your next step is to install Tor Browser from torproject.org, run the connection check, and read Dark Web Onion Links: What You Need to Know to understand what you might encounter once you are connected.