Tor (The Onion Router) is a free anonymity network and browser that routes internet traffic through several encrypted volunteer relays to hide the user’s location and identity.
How Tor works
Onion routing was developed at the US Naval Research Laboratory in the 1990s; the Tor software was released in 2002 and has been maintained by the non-profit Tor Project since 2006. A Tor client builds a circuit through three relays:
- the guard (entry) relay knows the user’s IP address but not the destination;
- the middle relay knows neither end;
- the exit relay connects to the destination but does not know who the user is.
Traffic is wrapped in layers of encryption, each removed by one relay – hence the onion metaphor. Onion services with .onion addresses go further: both client and server stay hidden, and traffic never leaves the Tor network. Bridges and pluggable transports such as obfs4 and Snowflake help users in countries that block Tor.
Why Tor matters for security
Journalists, activists, whistleblowers and ordinary users rely on Tor to avoid surveillance and censorship. Criminals use the same protection: the dark web marketplaces, ransomware leak sites and many forums run as onion services, and malware may use Tor for command-and-control traffic. The Silk Road marketplace, shut down by the FBI in 2013, showed that operators can still be identified through operational mistakes.
Tor also has limits. Exit relays can see and modify unencrypted traffic, so malicious exits have been caught tampering with HTTP connections, including stripping HTTPS to steal cryptocurrency. An adversary watching both ends of a connection may de-anonymise users through traffic correlation, and browser exploits or user mistakes can reveal identity.
Best practices
- Use the official Tor Browser, keep it updated and use only HTTPS sites.
- Do not log into personal accounts or open downloaded documents while using Tor.
- In corporate networks, monitor or block connections to public Tor relays if they are not needed.
