What is Tor? Three relays, one browser, and the things it can't hide

Tor is free software that hides who you are from the sites you visit, and hides which sites you visit from whoever is watching your connection. It sends your traffic through three randomly chosen relays in the Tor network, and the last one, the exit relay, passes it out to the public internet. The relays are run by volunteers all around the world. The site at the far end sees a connection from a Tor exit, not from you.

Most people never run Tor on its own. They use Tor Browser, which has it built in. It costs nothing. It hides your IP address, but not your name if you type it into a form, and not the fact that you're using Tor from your internet provider. Those two limits explain most of what goes wrong for people who rely on it.

Nobody on the path holds both ends. The thick lines are Tor's layered encryption. The dashed line is the exit-to-website leg, which is only encrypted if the site uses HTTPS.

How Tor hides your IP address

Your Tor client chooses a path of relays and builds what the specification calls a circuit, "a sequence of relays (typically three)". It negotiates a separate set of keys with each relay on the path, and each relay removes one layer of encryption before passing the data on. That's the onion: you wrap the layers, and each hop peels exactly one.

The layers exist so that no single relay has the whole picture. The spec says each relay on a circuit knows the relay before it and the relay after it, and none of the others. On a three-hop circuit that works out like this:

What each relay on a Tor circuit can and can't see
Relay	Knows	Doesn't know
Guard (first hop)	Your IP address, and which middle relay comes next	Which site you're visiting, or what you send
Middle	The guard and the exit	Your IP address and the site
Exit (last hop)	The middle relay, the site you're visiting, and your traffic to it if the site doesn't use HTTPS	Your IP address

The exit is the relay people worry about, and the worry is fair. Tor encrypts your traffic to and within the network, but the Tor Project says the encryption to the final website "depends on that website." On an HTTPS site the exit sees which site it is and an encrypted stream. On a plain-HTTP site it can read the page and change it. Onion sites don't use an exit at all, which is one reason they exist.

What does Tor stand for? Most explanations get it slightly wrong. You'll usually see Tor spelled out as "The Onion Router", Germany's federal cyber-security agency included. The Tor Project's own history says Roger Dingledine called the project Tor, "which stood for The Onion Routing", to tell the Naval Research Lab work apart from other onion routing projects of the time.

Tor, Tor Browser and onion sites are three different things

The Tor Project's own FAQ admits the name "can refer to several different components." Three of them matter to you:

Tor, the network and the program: The volunteer relays, plus the software on your device that builds circuits through them. It protects only what you point at it: Tor "only protects applications that are properly configured to send their Internet traffic through Tor." Everything else on your computer goes out the normal way.
Tor Browser: A version of Firefox ESR "heavily modified for use with the Tor network", with Tor built in. It does the work the network can't. It's built to resist tracking and browser fingerprinting, keeps no browsing history, and keeps cookies only until you quit or ask for a New Identity. That's why the Tor Project says it "strongly discourage[s]" using Tor with any other browser. Chrome pointed at Tor hides your IP and still hands every site a browser it can recognise. The Tor Browser guide covers getting a genuine copy, checking its signature and choosing a security level.
Onion sites: Services, like websites, that are "only accessible through the Tor network", at an address of 56 letters and numbers followed by ".onion". The site's location and IP address are hidden too, and the connection runs through six relays, three picked by you and three by the service, without ever leaving the network. This is what people mean by the dark web, and the dark web explainer picks up from here.

Is Tor legal?

In the United States, yes, and the evidence is better than the usual "it's just a browser" reassurance. EFF's lawyers have looked at something riskier than using Tor. They believe running a Tor relay, "including an exit relay," is legal under U.S. law, and they say they are not aware of anyone being sued, prosecuted or convicted for running one. Running a relay means other people's traffic leaves through your connection. Opening Tor Browser on your laptop is a much smaller act.

Is Tor illegal anywhere? The software isn't a crime in itself. The same FAQ describes Tor as "a tool for free expression, privacy, and human rights," not "a tool designed or intended to be used to break the law." What you do over it is judged like anything else you do online, and the dark web explainer covers where that line falls for onion sites. The real legal risk is elsewhere: in countries that block Tor, being seen to connect to it can matter on its own. Tor Metrics shows where blocking appears in the data, and the bridges guide covers connecting without the connection looking like Tor.

Don't expect the Tor Project to answer the legal question for your country. Its developers say they "cannot provide legal advice" and send people to the EFF FAQ, which is written for U.S. law.

Can your ISP see that you use Tor?

Yes, by default. What it loses is everything after that. Your provider, and anyone watching your connection locally, can't track your activity, "including the names and addresses of the websites you visit." The Tor Project's homepage puts the remainder plainly: "All anyone monitoring your browsing habits can see is that you're using Tor."

If that one fact is the problem, use a bridge. Tor says that by default it does not stop someone watching your traffic from learning you use Tor, and that a bridge reduces that risk. The Tor Project's other piece of advice isn't technical at all: "the more Tor users there are near you and the more diverse their interests, the less dangerous it will be that you are one of them." Being the only Tor user on a small office network is a different position from being one of thousands in a city.

A VPN in front of Tor also hides Tor from your ISP, but it hands your real IP address and your Tor use to the VPN company instead. Tor vs VPN sets out who sees what in each order.

What Tor doesn't protect against

Tor hides the route your traffic takes. It does nothing about what you type, what runs on your computer, or someone who can watch both ends of the route. These are the gaps that matter in practice:

Someone watching both ends. An observer who can see you and either the website or your exit can match the timing of your traffic going in and coming out. The Tor Project's own words: "Tor does not defend against such a threat model."
Signing in, or typing who you are. Once you give a site your name, email, address or phone number, "you are no longer anonymous to that website." Logging into your normal accounts over Tor hides your location, not your identity.
Files opened outside the browser. DOC and PDF files can fetch internet resources outside Tor when another program opens them, which "will reveal your non-Tor IP address."
Other apps. Only traffic you send through Tor is protected, and some programs ignore the setting. Torrent clients have been seen making direct connections when told to use Tor, and the Tor Project says that "Under no circumstances is it safe to use BitTorrent and Tor together."
A compromised computer. Malware on your own machine sees what you see before Tor touches it. That's the problem Tails and Whonix exist for, and Tails vs Whonix says which fits which risk.

Whether all this adds up to "Tor can be traced" depends on who is looking. Can Tor be traced? goes through the real cases where Tor users were identified and what actually gave each of them away.

Who made Tor, who runs it, and who pays for it

Tor came out of the U.S. Navy. In 1995, David Goldschlag, Michael G. Reed and Paul Syverson at the U.S. Naval Research Lab asked whether internet connections could be built that don't reveal who is talking to whom, and answered with the first onion routing designs and prototypes. Roger Dingledine joined Syverson on an NRL onion routing project in the early 2000s, Nick Mathewson followed, and when the network was first deployed in October 2002 its code was released under a free and open licence. EFF started funding Dingledine and Mathewson's work in 2004, the Tor Project, Inc. was founded as a 501(c)(3) nonprofit in 2006, and work on Tor Browser began in 2008.

The Tor Project writes the software. It doesn't run the network on its own: the network "has thousands of relays run by volunteers and millions of users worldwide." On an average day between 20 September and 19 October 2026, Tor Metrics estimates about 3.33 million users connected directly and about 214,000 more through bridges. Those are people online at once, not everyone who ever uses it. The 2026 Tor numbers explain how they're counted, where they are and how big the relay network is.

Tor is free to download and use. The Tor Project's sponsors page says "Tor doesn't sell your data to make money. Instead, 6,490 donors every year keep Tor strong." Donors are only part of the money, though. The latest year with published accounts shows where the rest comes from:

Where the Tor Project's revenue came from, July 2023 to June 2024 (Form 990 total: $7,287,566)
Source	Amount	Share
U.S. government	$2,556,472	35.08%
Corporations	$1,573,300	21.59%
Foundations	$1,395,494	18.67%
Individual donations	$1,102,619	15.61%
Non-U.S. governments	$552,387	7.58%
Other	$107,293	1.47%

Figures are from the Tor Project's post on its 2023–2024 financials, published in December 2025. The biggest single government funder was the State Department's Bureau of Democracy, Human Rights, and Labor, at $2,121,049, and the U.S. share has been falling: 53.5% of revenue in 2021–2022, 35.08% two years later. If U.S. government money bothers you, the open code is the check, not the Project's assurance. Anyone can read what Tor does.

The corporate line includes work with Mullvad on Mullvad Browser. On 9 October 2026 the Tor Project said it was "not terminating the relationship" but had "paused proactive co-branding with Mullvad." The note on the Tor Project's Mullvad decision covers why, and whether it changes anything for people using either browser.

Which Tor page answers your next question

You want to install it: How to use Tor Browser: the real download, signature checks on Windows, macOS and Linux, the iPhone situation, and what the three security levels block.
It won't connect, or you mustn't be seen using it: Tor bridges: which of obfs4, Snowflake, WebTunnel and meek works in Russia, Iran, China, Turkmenistan and Belarus, and how to get bridges when the website is blocked.
You're wondering whether to add a VPN: Tor vs VPN: Tor over VPN, VPN over Tor, and the setups where stacking them leaves you worse off.
You've been told I2P is the more private network: Tor vs I2P: Tor reaches the web, I2P stays inside itself, and I2P's own comparison page can't agree which is which.
You want to run part of the network: How to run a Tor relay: a middle relay on a server, not an exit on the connection you live on.
Being identified would put you in danger: Tails vs Whonix: what each leaves behind on a seized computer and what the two-machine split in Whonix is for.
You want to know if it actually works: Can Tor be traced?: traffic correlation, malicious relays, browser exploits, and the Silk Road case.
You want the numbers: How many people use Tor: users by country, censorship events, bridges, relays, onion services and speed, all from Tor Metrics.