What Tor Actually Does
Tor routes your traffic through three relays — a guard, a middle and an exit — each of which only knows its immediate neighbours. No single relay sees both who you are and what you are accessing. The exit relay sees the destination but not your IP. Your ISP sees you connecting to Tor but not what you do inside it.
This is not a VPN. A VPN shifts trust to one provider. Tor distributes trust across a volunteer network so that no single entity can correlate sender and destination.
Installing the Tor Browser
The Tor Browser is a hardened Firefox fork bundled with the Tor client. Always download it from the official source.
On Ubuntu / Debian
sudo apt update
sudo apt install -y torbrowser-launcher
torbrowser-launcherThe launcher verifies the GPG signature automatically on first run. If you prefer a manual install:
wget https://www.torproject.org/dist/torbrowser/13.5.9/tor-browser-linux-x86_64-13.5.9.tar.xz
wget https://www.torproject.org/dist/torbrowser/13.5.9/tor-browser-linux-x86_64-13.5.9.tar.xz.asc
gpg --keyserver keyserver.ubuntu.com --recv-keys 0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290
gpg --verify tor-browser-linux-x86_64-13.5.9.tar.xz.asc
tar -xf tor-browser-linux-x86_64-13.5.9.tar.xz
cd tor-browser
./start-tor-browser.desktopReplace the version number with the current release from torproject.org.
On Windows
Download the installer from torproject.org/download. Verify the GPG signature if you are in a hostile environment. Run the installer and launch from the Start menu or desktop shortcut.
First Launch and Connection
On first launch the browser presents a connection screen. For most users, clicking Connect is sufficient. The browser establishes a circuit and opens a landing page confirming you are connected.
To check your exit node IP at any time, visit check.torproject.org.
Using Bridges When Tor Is Blocked
If your ISP or network blocks direct connections to Tor relays, you need a bridge — an unlisted relay that censors cannot easily enumerate.
Open the Tor Browser connection settings and select Configure. Enable Use a bridge and choose one of:
- obfs4 — the most common pluggable transport; obfuscates Tor traffic to look like random noise
- Snowflake — routes through volunteer browser proxies; harder to block at scale
- meek-azure — tunnels through Microsoft Azure CDN; useful in heavily censored environments
For a custom bridge, request one from bridges.torproject.org and paste the bridge line into the configuration field.
Security Levels
The Tor Browser has three security levels, accessible from the shield icon in the toolbar:
- Standard — all browser features enabled. Suitable for general browsing where anonymity is the goal but sites need full functionality.
- Safer — disables JavaScript on non-HTTPS sites, blocks some fonts and media. A reasonable default for sensitive work.
- Safest — disables JavaScript entirely, blocks fonts, icons and media. Some sites will break. Use this when you need maximum protection against browser exploits.
Set it to Safer as a baseline and move to Safest when the task warrants it.
Operational Discipline
Tor protects your network identity. It does not protect you from yourself. These rules matter:
Never Log In to Personal Accounts
Logging in to Gmail, Facebook or any service tied to your real identity over Tor links your Tor session to your identity. The circuit encryption is irrelevant at that point.
Do Not Torrent Over Tor
BitTorrent clients leak your real IP through tracker announcements and DHT. The Tor network is not designed for bulk file transfer.
Do Not Resize the Browser Window
The Tor Browser ships at a standard resolution to make all users look identical. Resizing creates a fingerprint. Leave the window as it opens.
Do Not Install Browser Extensions
Every extension changes your browser fingerprint. The Tor Browser includes only what is needed. Adding uBlock, LastPass or anything else makes you distinguishable.
Treat the Session as Disposable
When you close the Tor Browser, it wipes all session data — cookies, history, cache. This is by design. Do not try to persist state between sessions.
Running Tor as a System Service
For applications beyond the browser — SSH tunnelling, command-line tools, scripting — you can run the Tor daemon directly:
sudo apt install tor
sudo systemctl enable tor
sudo systemctl start torThe SOCKS5 proxy listens on 127.0.0.1:9050. Route traffic through it:
curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org/api/ipFor persistent use, configure /etc/tor/torrc:
SocksPort 9050
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/torRestart after changes:
sudo systemctl restart torVerifying Your Configuration
After connecting, confirm these:
check.torproject.orgshows a green message confirming Tor is in use- Your exit IP does not match your real IP
- DNS leak tests at
dnsleaktest.comshow Tor exit nodes, not your ISP's resolvers - The security level indicator shows Safer or Safest
What Tor Does Not Protect Against
- Compromised exit nodes — if you send unencrypted traffic (plain HTTP), the exit relay can read it. Always use HTTPS.
- Timing correlation — a powerful adversary monitoring both your entry and the destination can correlate traffic patterns. This is a theoretical threat for most users but a real one for high-value targets.
- Browser exploits — a zero-day in Firefox can deanonymise you regardless of Tor. The Safest security level mitigates this by disabling JavaScript.
- User error — logging in, revealing personal information, or mixing Tor and non-Tor activity in the same workflow.
Summary
Tor is a tool, not a magic cloak. Install the browser from the official source, use bridges if your network blocks Tor, set the security level to Safer at minimum, and maintain strict separation between your Tor activity and your real identity. The technology works. The weak point is always the operator.