Tor vs VPN: who sees you, and why stacking them usually fails

Who sees your IP, and who sees the site

Five setups, and a different observer in each. Tor's own pages and its older wiki leave some cells open, and Whonix's later write-up disagrees on a few; the text under the table says where.

Read the last column before you pay anyone. VPN-then-Tor still shows the site a Tor exit. Tor-then-VPN shows the site a VPN address and hands that company the list of where you went. Tor alone shows the site a Tor exit and hands nobody both ends at once.

Tor over VPN and VPN over Tor

People say "Tor over VPN" and "VPN over Tor" as if the phrases were self-explanatory, and they are not. Whonix asks you to name the order instead: user, then VPN, then Tor, then the internet, or user, then Tor, then VPN, then the internet. The first is a VPN in front of Tor. The second is a VPN behind it. The Tor Project's current support page does not draw that picture. It says combining a VPN with Tor can reduce your anonymity or break Tor's protections if you configure it wrong, and that they don't recommend it unless you already know how to configure both. The detail is on a Tor wiki page, quoted here from its March 2018 archive, so read its statements about VPN and Tor behaviour as dated 2018.

On the VPN-before-Tor order, the wiki says you can route Tor through the VPN so your provider might not see that you are using Tor. It also says this "can be a fine idea, assuming your VPN provider's network is in fact sufficiently safer than your own network," because someone who breaks Tor would learn the VPN's address rather than your provider's. The same page's warning is the part the affiliate guides skip: a VPN or SSH "acts either as a permanent entry or as a permanent exit," you "can very well decrease your anonymity" by adding one, and most providers log and leave a money trail unless you can pay anonymously.

The other order gets a harder label. The wiki's heading for "you, then Tor, then something else" is "generally a really poor plan." Tor normally changes its path. A permanent VPN at the end gives that up. The VPN hides your traffic from the Tor exit, which is a real property, and then "the VPN can build a profile of everything you do, and over time that will probably be really dangerous." Doing it at all, the wiki says, is hard without virtual machines, the VPN has to run in TCP mode because Tor does not carry UDP, and "establishing VPN connections through Tor is chancy."

Whonix's tunnel page, which mentions the 2024 port-shadow attacks on shared VPN servers, is harsher about the first order than that wiki was. It calls the extra protection of VPN-then-Tor questionable, says a bridge is the simpler way past a block, and says hiding Tor from an ISP with a VPN, a proxy, a bridge or an SSH tunnel has been "assessed as difficult beyond practicality." On Tor-then-VPN it matches the wiki's worry in plainer operational terms: one circuit instead of Tor Browser's separate circuits, so your tabs sit on the same path, onion sites stop working because the last hop is no longer Tor, and a global observer has a short list of VPN exits to watch. The anonymity effect, in Whonix's own comparison table, is "disputed" for every order. That is the honest cell. Anyone who fills it with a checkmark is selling the row.

One limit sits in the middle of both documents and gets left off commercial charts. The wiki says a VPN does not strongly guarantee that your ISP cannot tell Tor is inside it, because encrypted VPN traffic can still be fingerprinted, and that it knew of no research paper specifically on classifying Tor hidden inside a VPN. That "no paper" sentence is from the old wiki, not a claim about 2026. Whonix's later page treats website-traffic fingerprinting as a reason the VPN-then-Tor disguise is very weak, and its table scores "hide Tor and Whonix from ISPs" as "very weak" for a VPN in front and "no" for a VPN behind. If your reason for paying was "my ISP must not know," you are betting on a disguise both sources describe as weak, against a bridge, which is the tool Tor and Tails name for that job.

Hiding Tor from your ISP

Should you use a VPN with Tor so your provider only sees a VPN? That is the most common reason people give, and it is the reason Tor answers with a bridge. Its safety page separates two facts: it tries to keep a watcher from learning which site you opened, and a watcher on your connection can still learn that the traffic is Tor unless you use a bridge. The tracing page quotes that paragraph in full. The decision here is what to add. Tor names a bridge. It does not name a subscription.

Tails says the same thing in its warnings: your ISP can see that you connect to Tor and cannot see the sites, and a bridge is how you hide the connection. The only VPN sentence on that page is a comparison, not a recommendation: against an attacker watching both ends, a VPN is less secure than Tor because it does not use three independent relays. Tor's own note on that attack is that it does not defend against an observer who can see you and either the site or your exit at the same time. A VPN in front does not remove an end that observer already has. Which bridge to use where Tor is blocked, or where being seen to use Tor is the problem, is a separate decision from buying a subscription.

Tails currently does not work with VPNs at all. If you moved to Tails because a guide told you to run both, the VPN half of that guide is dead on arrival. The FAQ's reason is the single provider who sees both ends, and it says a future Tails might add a separate browser that uses a VPN instead of Tor. Instead of. Not stacked.

Streaming, public Wi-Fi, journalism, censorship

The useful answer depends on which observer you actually have. These are the common ones.

Ordinary browsing you don't want tied to your name

Tor Browser, no VPN. Tor lists VPNs among the things that interfere and "need to be disabled." Standard security level is enough for reading. The install and the levels are in the Tor Browser guide.

A café or hotel network

The local network is the watcher Tor is talking about. Tor hides the site names from it. A VPN also hides them, and the company sees both ends. Use the VPN if you need sites that break in Tor Browser and you are logging into your ordinary accounts anyway. Use Tor Browser if the point is that the sites don't get the café's picture of you. Don't run both because the café feels sketchy. Sketchy local networks are the easy case.

Streaming, or any site that refuses Tor exits

Many sites already CAPTCHA or block Tor because the exit list is public. A video service that insists on a residential or datacenter address will not play over an exit. Tor-then-VPN is the arrangement that shows a VPN address instead, and both the wiki and Whonix tell you what you give up to get it. For watching video, use a VPN and leave Tor out. You are not anonymous from the VPN company or from the account you sign into. Which VPNs have audits and court cases behind their no-logs claim is on the privacy tools page.

Journalism, or anyone who would be hurt if named

Do not add a commercial VPN you paid for with a bank card. The wiki's point about the money trail is that an adversary looks at the weakest link first, and a VPN account in your name is a weak link with a receipt. If the danger is that someone can see you using Tor, use a bridge. If the danger is what a seized laptop still has on disk, the operating system is the decision, and Tails and Whonix split that problem differently. Correlation by an agency that can watch both ends is still open. A VPN does not close it.

Tor is blocked where you are

A bridge with a pluggable transport first. Whonix says bridges are what you will probably need against state censorship, and that a VPN is often censored in the same places. VPN-then-Tor is the fallback the wiki allows when your network is hostile, Tor is blocked, and the VPN still connects, and only if you accept that the VPN company sees your address and sees you entering Tor. The country-by-country bridge choice is the page to use before you subscribe to anything.

When Tor and a VPN together make you less safe

Tor and a VPN together add a party. They do not add a layer in the way the ads mean it. The failure modes are specific.

• The VPN client fights Tor. Tor's known-issues list tells you to turn VPNs off. A proxy left configured has a sharper edge: "Tor can not use a bridge if a proxy is set." The thing you installed to help can be the reason the bridge never connects.
• The VPN drops, and traffic goes out direct. The wiki describes the ordinary failure: the VPN process crashes or the server reboots, and without a kill switch the machine talks to the internet on its own. That is how a "Tor over VPN" setup becomes a normal connection while you still think you are covered.
• You become a permanent entry or a permanent exit. Tor's path changes. The VPN doesn't. A provider who is the adversary, or who folds when asked, weakens the protection Tor was giving you. The wiki is blunt that a trustworthy provider can help and an adversary-controlled one does the opposite. You usually cannot tell which you bought.
• Tor-then-VPN collapses Tor Browser's separation between tabs, and Whonix says the result is so unusual that your browser no longer looks like other Tor Browser users. The tunnel that was supposed to hide you is what makes the browser rare.

Whonix also notes a 2024 attack it calls port shadow, against the shared ports on VPN servers, which in the worst cases allowed snooping of unencrypted traffic, port scans or connection hijacking. That is a VPN problem, with or without Tor. It is one more reason "add a VPN" is not a free upgrade. The same page's bottom line matches the support article: for the vast majority of users, Tor without a VPN or a proxy is the correct choice.

Is Tor a VPN? The name collision

No. Tor Browser is a browser that uses the Tor network. A commercial VPN is a tunnel to one company's server. They are different objects, and the Tor Project has now shipped something that uses the confusing name on purpose.

Tor VPN is the Tor Project's own Android app. It routes other apps on the phone through Tor, hides the phone's address from those apps' servers, and can reach onion services. The project's warning, on the manual's front page, is that it is beta software, may leak, and should not be relied on for anything sensitive. It runs only on Android 7.0 or newer, on phones, not on tablets or Chromebooks, and the project tells you to install it from Google Play or F-Droid. Tor's censored-regions page lists it next to Tor Browser and Tails as a place WebTunnel bridges work. That is a circumvention feature of their app. It is not a reason to put Nord, Express, or Mullvad "over" Tor Browser on a laptop.

If a guide says "use Tor VPN" and then shows you a checkout page, it is talking about a product the Tor Project does not sell. The app is free, it is Android-only, and the people who wrote it say not to trust it for high-risk use yet. Desktop users who want Tor still want Tor Browser.

How to tell whether traffic is actually going through Tor

The quick check is a page on Tor's own site, with one precondition: turn other tunnels off first.

1. Quit the VPN app, and any proxy, before you judge Tor. Tor's known-issues page says VPNs tend to interfere and need to be disabled, and that a configured proxy stops bridges from working. A test run while the VPN is up is a test of the stack, not of Tor Browser.
2. Open check.torproject.org in Tor Browser, not in your normal browser. An ordinary browser gets the answer "Sorry. You are not using Tor." If you see that sentence in the browser you thought was Tor, stop and fix the connection before you do anything else. Tor also warns that making Tor Browser the system default is unreliable, so a click can land in the other browser and look like a leak that is really a wrong window.
3. Look at what the check thinks your address is. A site you reach through Tor is supposed to see an exit, not the address your provider gave you. A third-party "DNS leak" page opened inside Tor Browser will show the exit's resolver. That is the design. The failure is a page that shows your home provider. Then the request did not go through Tor, which is the same failure as the "not using Tor" line, just measured from the other direction.

The leaks Tor bothers to name in its safety guide are not VPN dashboards. They are plugins that can be made to reveal your address, documents that phone home when an outside app opens them, and any program on the computer that was never configured to use Tor. Tor only covers applications that send their traffic through it, and the project tells you not to push a different browser through the network. Passing check.torproject.org in Tor Browser says that browser is on Tor. It says nothing about the mail client, the updater, or a VPN process you left running beside it.

Tor's support pages, the Tor VPN warning and the check page were last read on 21 October 2026. The longer Tor-plus-VPN quotations come from the wiki's March 2018 archive and from Whonix's tunnel page, the later of the two, which also covers the 2024 VPN attacks.