What Is Tor, How Does It Work, and How Can You Use Tor Browser Safely?

Tor is a privacy system designed to make online activity harder to trace. It can help people avoid routine tracking, reach information blocked by authorities and communicate without immediately revealing their location. The same privacy protections can also conceal criminal activity, which has made Tor both an important anti-censorship tool and a frequent subject of controversy.

Using Tor does not make someone completely anonymous, nor does it make every website or download safe. Understanding what the network protects—and what it does not—is essential before using Tor Browser or visiting services on the darknet.

What is Tor?

Tor stands for The Onion Router. The name refers to the layered encryption system, known as onion routing, that the network uses to move traffic through multiple computers before it reaches its destination.

Tor includes a decentralized network of volunteer-operated computers and free software for connecting to that network. For most people, the simplest access method is Tor Browser, a specialized browser available to the public.

Tor can be used to browse ordinary websites, access services that use .onion addresses and, with suitable software, support activities such as messaging, email and service administration. Its users include:

• People who want to reduce online tracking
• Journalists and their sources
• Whistleblowers concerned about being identified
• Residents of countries where news and other information are censored
• People seeking illegal goods, services or content

Tor therefore has no single purpose. It is a privacy technology that can be used for lawful or unlawful activity, much like other communication tools.

How onion routing works

With a conventional browser connection, a device normally contacts the server hosting the requested website through an internet service provider. This can expose information about the parties involved in the connection, including the user's IP address.

Tor changes that route. It encrypts the request in multiple layers and sends it through a randomly selected path of network relays. Each relay removes one encryption layer and learns only enough information to forward the traffic to the next point.

The three-part route

A typical Tor circuit involves several relay roles:

1. Entry relay: The first relay receives the connection from the user's device but does not know the final destination.
2. Middle relay: An intermediate system passes the traffic along without knowing both the original user and the destination.
3. Exit relay: The final relay sends the request to a regular internet service. To that service, the request appears to originate from the exit relay rather than from the user's IP address.

No individual relay is intended to know the complete route. Each generally knows only the relay immediately before it and the one to which it must forward the traffic. This separation makes traffic analysis and user tracking substantially more difficult.

The network is decentralized and depends on computers run by volunteers. In May 2022, it had approximately 7,000 relays.

Where Tor came from

Onion-routing technology was developed in the mid-1990s at the United States Naval Research Laboratory. The U.S. government funded research into ways intelligence organizations could communicate securely.

Tor was publicly presented in 2002, and its source code was released under a free license in 2003. The Electronic Frontier Foundation later supported its development. Today, Tor is maintained by the Tor Project, a nonprofit organization founded by members of the original development team.

U.S. government institutions, including the Department of State, have remained among the project's significant donors. Although that history may appear contradictory, a privacy network works best when its users blend into a large and varied population rather than a small group of government personnel.

Tor, the deep web and the darknet

These terms are related but not interchangeable.

• Clear web: Publicly accessible websites that can be opened with standard browsers and are commonly indexed by search engines.
• Deep web: Online content that is not publicly indexed, such as private accounts, databases and restricted services. Most deep-web content is ordinary and lawful.
• Darknet: Services intentionally hidden and accessible through specialized software. Tor's .onion services are part of the darknet.

Tor Browser can open both regular websites and .onion services. A conventional browser generally cannot resolve or connect to an .onion address.

Is Tor safe?

Tor itself is neither inherently safe nor inherently dangerous. It protects parts of a connection, but it cannot guarantee that a website is trustworthy, a file is harmless or a transaction is legitimate.

A 2020 study estimated that 6.7% of daily Tor users were probably using the network for illegal purposes. Examples included markets for drugs and weapons, ransomware and other malicious software, stolen payment data, bank fraud, money laundering and child sexual abuse material.

The same research indicated that likely illicit use was more common in democratic countries, while people in countries with restrictions on speech were more likely to use Tor to circumvent censorship. Privacy advocates also note that criminals have tools other than Tor for hiding their activity.

The practical lesson is that encountering a service through Tor says little about whether it is safe or legal. Users must evaluate each destination and comply with the laws that apply to them.

Does Tor provide complete anonymity?

No. Tor can provide strong privacy protections, but it does not guarantee 100% anonymity.

When Tor Browser is working as intended, an internet service provider or someone monitoring the user's local connection can generally see that the device is communicating with the Tor network, but not which final websites it visits. Destination websites see a connection from Tor rather than the user's original IP address.

Tor Browser also removes cookies when a session ends or when the user selects New Identity. This limits the ability of websites to link activity across separate Tor sessions through persistent cookies.

However, the existence and timing of traffic entering and leaving the network can still be observed. A sufficiently capable observer may attempt to correlate those patterns. Anonymous and non-anonymous activity can also become associated through traffic analysis or behavior at an exit point.

Tor hides a network route; it does not automatically prevent every form of identification. Privacy still depends on how the browser, websites, accounts, downloads and communications are used.

How to install Tor Browser

Tor Browser should be obtained through the Tor Project's official distribution channel. Versions are available for Windows, macOS, Linux and Android. There is no official Tor Browser for iOS; the project recommends Onion Browser for Apple mobile devices.

The browser has been offered in 36 languages, including Polish. Installation is similar to installing another browser:

1. Download the installer for the correct operating system from the official Tor Project source.
2. Run the installer and launch Tor Browser.
3. Choose whether to connect directly or open the connection configuration.
4. Select the preferred security level.
5. Decide whether future Tor connections should start automatically.

Security levels

Tor Browser provides three security levels:

• Standard: Enables the browser's normal website features.
• Safer: Restricts some potentially risky web capabilities.
• Safest: Applies the strongest restrictions, including disabling JavaScript by default on all websites. Media also requires a click before it plays.

Stricter settings can reduce exposure to risky website features, but they may also cause some pages to work incorrectly.

Using bridges where Tor is blocked

Some governments and network operators attempt to block direct access to Tor. The browser's Use a Bridge option is designed for these situations. A bridge is a Tor relay that is not listed in the same public way as ordinary relays, making connections harder to identify and block.

This option is relevant in countries where Tor access is restricted. Russia's communications regulator, Roskomnadzor, banned Tor in December 2021, while countries including China and Vietnam have also imposed extensive controls on internet access and press freedom.

Using Tor Browser

After connecting, users can either search for and visit regular websites or enter a known .onion address.

Tor Browser includes DuckDuckGo as a search option. Unlike advertising models built around extensive behavioral profiling, DuckDuckGo says it does not record, collect or share users' personal information or search histories. Within Tor Browser, it is primarily useful for searching the clear web.

Some regular websites also operate official .onion versions. When one is available, Tor Browser may offer a button for switching to it. An onion service keeps the connection within the Tor environment rather than sending it through an exit relay to the regular web.

How to access onion services

To open an onion service, enter its complete .onion address in Tor Browser. These addresses are long strings of characters and must be copied accurately. Entering one into Chrome or another conventional browser will normally produce an error because those browsers do not connect to the Tor network.

Finding legitimate, current onion addresses can be difficult. Specialized directories exist, but many are unmoderated. They may contain obsolete listings, scams or links to illegal and disturbing material. Whenever possible, an onion address should be obtained from the verified public materials of the organization operating it rather than from an unknown directory.

Well-known organizations that have operated onion services include:

• BBC
• DuckDuckGo
• Facebook
• The New York Times
• Twitter

Such services can provide alternative access to news, search and communication platforms, particularly for people living under censorship. Tor is also used by whistleblowers who need to communicate with journalists while reducing the risk that their location or identity will be exposed.

Safety precautions for the darknet

Darknet services require the same caution as the regular internet—and often considerably more. The network's privacy protections also shield scammers and malicious operators.

Treat directories as untrusted

Unmoderated directories can point to illegal markets, malicious software, fraudulent services and abusive content. A directory listing is not evidence that a service is authentic, lawful or safe.

Be cautious with downloads

Files from unknown darknet sites may contain malware, including ransomware that encrypts or blocks access to a device's data and demands payment. Avoid downloading files from services whose identity and reputation cannot be established.

Do not assume cryptocurrency prevents fraud

Darknet transactions are commonly conducted with cryptocurrencies, but the payment method does not make a seller trustworthy. Scams are widespread, and anonymity makes it difficult to identify a seller or recover funds.

Use the appropriate browser protections

The Safer or Safest security level can reduce exposure to active website features. Users in locations where Tor is blocked should consider the bridge configuration rather than repeatedly attempting a direct connection.

Remember Tor's limits

Tor can hide an IP address and obscure browsing destinations from local observers, but it cannot make unsafe content harmless or provide absolute anonymity. Traffic correlation remains possible, and actions performed during a session may still reveal information.

What Tor ultimately provides

Tor is best understood as infrastructure for privacy and censorship resistance—not as a synonym for criminal activity and not as an invisibility cloak. It separates a user's connection from its destination by sending traffic through layered encryption and multiple volunteer relays.

That design can protect journalists, sources, whistleblowers and ordinary users who do not want their browsing routinely tracked. It can also be misused. Safe use therefore requires realistic expectations, restrictive security settings when appropriate, careful handling of onion addresses and strong skepticism toward unknown files, directories and transactions.